Ground Station Unauthenticated Socket.IO Database Destruction and Injection Vulnerability

Technical Analysis

The vulnerability resides in the database_backup Socket.IO event handler on port 7000, which lacks authentication enforcement and uses a wildcard CORS policy, permitting any unauthenticated network peer to connect. By emitting a full_restore command with an attacker-supplied SQL blob, the handler executes raw exec_driver_sql calls that drop all existing tables and recreate the database using attacker-controlled CREATE TABLE and INSERT INTO statements, resulting in complete data destruction or planted malicious records. This enables attackers to redirect the ground station's next scheduled sync to attacker-controlled servers by injecting fabricated orbital-source URLs, facilitating further payload delivery or man-in-the-middle scenarios. The CVSS score of 9.1 reflects the low attack complexity, lack of authentication, and high impact on integrity and availability. If Ground Station or similar telemetry/control software is integrated into autonomous AI agent pipelines (e.g., agents consuming orbital data, scheduling observations, or pulling configuration from this backend), the unauthenticated database corruption or injected malicious URLs could poison agent inputs, redirect agent-driven data retrieval to attacker infrastructure, or cause agents to act on fabricated operational data.

Affected Systems

Ground Station software versions prior to 0.6.0; specifically the Socket.IO server component listening on port 7000 with disabled authentication and wildcard CORS configuration; underlying SQLite database instances managed by this service.

Indicators of Compromise

• Port 7000 Socket.IO connections from unrecognized/external IPs
• Outbound event: database_backup with full_restore payload
• Unexpected CREATE TABLE / INSERT INTO statements in Ground Station SQL logs
• Unauthorized modification of orbital-source URL fields pointing to non-standard/external domains
• Sudden full database schema replacement or data loss in Ground Station SQLite files

Remediation Steps

1. 1

   Upgrade Ground Station

   Update to Ground Station version 0.6.0 or later, which addresses the unauthenticated database_backup handler and enforces proper authentication.

2. 2

   Restrict Network Access to Port 7000

   Implement firewall rules or network segmentation to limit access to the Socket.IO server (port 7000) to trusted internal hosts only.

3. 3

   Enforce Authentication on Socket.IO Server

   Enable and enforce authentication mechanisms for all Socket.IO event handlers, especially those capable of destructive database operations.

4. 4

   Fix CORS Policy

   Replace wildcard CORS configuration with an explicit allowlist of trusted origins to prevent cross-origin exploitation.

5. 5

   Audit and Restore Database Integrity

   Review database backups and audit logs for signs of unauthorized full_restore events; restore from known-good backups if compromise is suspected.

6. 6

   Monitor for Anomalous Orbital-Source URLs

   Implement validation and monitoring of orbital-source and observation schedule data for unexpected external URLs or fabricated entries before use in downstream sync operations or agent pipelines.