OpenC3 COSMOS Script Runner: Privilege Escalation via Docker Network Access and Credential Exposure

Vulnerability Description:

This is an execution-with-unnecessary-privileges vulnerability stemming from insufficient network segmentation and over-permissive container capabilities. The Script Runner widget allows authenticated users to execute arbitrary Python/Ruby scripts; however, these scripts run with full network access to internal services without additional authorization checks. The root cause is the failure to enforce defense-in-depth principles: the API permissions model only controls widget-level access but does not restrict the underlying container's network capabilities. This creates a privilege boundary bypass where users authenticated as non-administrators can conduct lateral movement to Redis and S3 buckets, leading to secrets disclosure and configuration tampering.

PoC Significance:

The disclosed PoC proves that environment variables containing sensitive credentials (Redis username, password, hostname, port) are discoverable within the Script Runner container and require no brute-forcing or source code analysis. The reliability is high because: (1) internal services are exposed via standard Docker networking, (2) credentials are stored in plaintext environment variables, and (3) the Docker network isolation is the only security boundary. Preconditions are minimal—only script creation/execution permission is needed. This PoC demonstrates the exploitation chain is practical and repeatable, making it an attractive vector for insider threats or compromised low-privilege accounts.

Detection Guidance:

Monitor for: (1) unusual network connections initiated from the script-runner-api container to Redis (port 6379) or S3-compatible storage (port 9000) that deviate from expected administrative patterns; (2) environment variable read operations (env command, os.environ in Python) within script execution logs; (3) authentication attempts to Redis/S3 with credentials matching discovered environment variables; (4) container process activity showing direct socket connections outside the Script Runner's intended API boundary; (5) modifications to Redis keys controlling COSMOS configuration or secrets storage. Enable network flow analysis and container runtime monitoring to detect lateral movement. Log all script submissions and their network destinations.

Mitigation Steps:

1. Immediate: Upgrade to patched OpenC3 COSMOS version when available; verify the patch enforces network policies at the container or kernel level.
2. Network Segmentation: Isolate the script-runner-api container on a restricted Docker network with no direct access to Redis or S3; route all administrative operations through a hardened proxy API gateway that enforces authentication and authorization.
3. Credential Management: Remove credentials from environment variables; use Docker secrets or external secret vaults (HashiCorp Vault, AWS Secrets Manager) with short-lived token injection.
4. Capability Reduction: Apply the principle of least privilege—restrict script runner capabilities (e.g., remove NET_RAW, limit file system access) and enforce read-only mounts where possible.
5. Script Sandboxing: Implement sandboxed script execution using seccomp profiles or OS-level restrictions to prevent direct socket API calls.
6. RBAC Enforcement: Enforce script execution permissions tied to specific operations, not blanket network access.

Risk Assessment:

Likelihood of exploitation in production is high if COSMOS deployments include untrusted or semi-trusted users with script permissions. Financial services, industrial control systems, and large-scale data pipelines are preferred targets. Threat actors with initial foothold access will prioritize Script Runner as a privilege escalation pivot point. The low barrier to exploitation (knowledge of container networking, basic scripting) and high impact (secrets disclosure, configuration sabotage) make this a critical priority for defenders. Organizations should assume active exploitation in legacy unpatched deployments.