# GPSD gpsprof gnuplot command injection via attacker-controlled GPS metadata ## VulnCheck report fields Name to Credit: ```text CuB3y0nd ``` Email: ```text root@cubeyond.net ``` Submitting on behalf of someone else: ```text No, I discovered this vulnerability myself. ``` Affected Software: Vendor name: ```text GPSD project ``` Affected Software: Product name: ```text GPSD gpsprof / gpsd-clients Affected component: gpsprof-generated gnuplot program ``` Tested Version(s): ```text Repository: https://gitlab.com/gpsd/gpsd.git Commit: a4bd4cbc2d2d739e11b8186af8f916724f9bc81e Version string: release-3.27.5-306-ga4bd4cbc2 PoC environment: Ubuntu 24.04 container with gnuplot-nox and Python 3 Validation date: 2026-06-27 ``` Vulnerability Details: ```text GPSD's shipped gpsprof client generates a gnuplot program from GPS device metadata. A malicious GPS/NMEA producer, or an attacker-controlled gpsprof JSON log, can place gnuplot command-substitution syntax in DEVICES.devices[0].subtype. gpsprof includes that subtype in the default plot title and escapes only double quotes before writing `set title`. When the victim renders the generated program with gnuplot, the command executes as the gnuplot renderer user. ``` Disclosure coordination: ```text Yes, I would like VulnCheck to handle vendor outreach and coordinate disclosure on my behalf. ``` Previous MITRE CVE request: ```text False ``` Already publicly disclosed: ```text No direct public disclosure of this GPSD gpsprof/subtype-to-gnuplot command injection was found in quick searches as of 2026-06-27. Generic gnuplot command-injection/title-injection behavior exists as prior art, but no direct GPSD gpsprof route match was identified. ``` Generated with AI: ```text True. AI assistance was used for vulnerability research workflow automation, analysis, and PoC packaging; the attached PoC is directly reproducible. ``` Validated on production code: ```text Yes. The PoC fetches and uses GPSD production source from the upstream GitLab repository at commit a4bd4cbc2d2d739e11b8186af8f916724f9bc81e. The reproduction environment is a Docker lab. ``` Shodan/Fofa query: ```text Not applicable. This issue is triggered through GPS producer/log input plus the documented gpsprof-to-gnuplot rendering workflow, not by identifying exposed web instances. ``` Publication plan: ```text Not sure. I will follow coordinated disclosure guidance. ``` ## Impact The demonstrated impact is command execution as the user running gnuplot. The payload is intentionally limited to: ```text id>/tmp/gpsd_gpsprof_marker ``` Boundary: ```text This is not gpsd daemon RCE. The command runs in the renderer context after a victim/operator or an equivalent workflow renders gpsprof output with gnuplot. It is not root unless the renderer runs as root. ``` ## CVSS 3.1 Requested score: ```text CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Base score: 9.6 Critical ``` Rationale: ```text AV:N: A live trigger can be delivered through a malicious or network-proxied GPS producer/feed that supplies device metadata to gpsd. AC:L: The live NMEA route uses a normal checksum-valid PGRMT sentence and the documented gpsprof/gnuplot rendering workflow. PR:N: The attacker side does not require an account on the victim host. UI:R: A victim/operator or equivalent workflow must render gpsprof output with gnuplot. S:C: gpsprof is the vulnerable GPSD component that emits an unsafe gnuplot program; the final command executes in the separate renderer/shell context. C:H/I:H/A:H: Command execution in the renderer user's context can read, modify, or delete data and run arbitrary programs available to that user. ``` ## Root cause The live NMEA route starts when gpsd accepts Garmin `PGRMT` as sensor metadata and copies the first data field into the device subtype without constraining it for later non-JSON interpreters: ```c // drivers/driver_nmea0183.c, a4bd4cbc2d2d 4244 static gps_mask_t processPGRMT(unsigned count UNUSED, char *field[], 4245 struct gps_device_t *session) ... 4266 strlcpy(session->subtype, field[1], sizeof(session->subtype)); ... 6298 {"PGRMT", NULL, 10, false, processPGRMT}, // Garmin Sensor Info ``` gpsd then publishes this subtype as a normal `DEVICES` JSON string. This is valid JSON escaping, but it is not escaping for the later gnuplot program context: ```c // gpsd/gpsd_json.c, a4bd4cbc2d2d 802 if ('\0' != device->subtype[0]) { 803 (void)strlcat(reply, ",\"subtype\":\"", replylen); 804 (void)strlcat(reply, 805 json_stringify(buf1, sizeof(buf1), device->subtype), 806 replylen); 807 (void)strlcat(reply, "\"", replylen); ``` `gpsprof` stores the received `DEVICES` object as the selected device and includes `subtype` in the default plot title: ```python # clients/gpsprof.py.in, a4bd4cbc2d2d 187 def whatami(self): ... 196 if 'path' in self.device: 197 desc += ", %s" % self.device['path'] 198 if 'subtype' in self.device: 199 desc += "\\n%s" % self.device['subtype'] ``` Before writing the gnuplot program, `gpsprof` escapes only double quotes. It does not escape gnuplot command-substitution syntax, so a subtype containing a backtick command is emitted inside `set title` and executed when gnuplot renders the generated program: ```python # clients/gpsprof.py.in, a4bd4cbc2d2d 1263 if not options.title: 1264 options.title = plot.whatami() 1265 # escape " for gnuplot 1266 options.title = options.title.replace('"', '\\"') ... 1276 # double quotes on title so \n is parsed by gnuplot 1277 sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) ``` ## Real trigger variants Minimal file trigger: ```text An attacker supplies a gpsprof JSON log containing one DEVICES record with a crafted subtype and enough TPV records for gpsprof to complete. The victim then runs a documented replot flow. ``` Example victim workflow: ```bash gpsprof -r -T dumb < malicious.jsonl > output.plot gnuplot output.plot ``` Lower-complexity live device trigger: ```text A malicious, emulated, spoofed, or network-proxied NMEA producer sends a checksum-valid PGRMT sentence whose first field is the gnuplot payload, plus ordinary fix sentences. When a victim later runs `gpsprof | gnuplot`, the device subtype reaches the same title sink. ``` UBX live variant: ```text UBX-LOG-RETRIEVESTRING can inject forged gpsd JSON records before the same gpsprof/gnuplot sink. That route is useful for u-blox producer scenarios, but the NMEA PGRMT route is simpler because it uses normal DEVICES.subtype directly. ``` ## Run ```bash ./exp.py ``` Expected success indicator: ```text gpsd gpsprof gnuplot command execution reproduced uid=0(root) gid=0(root) groups=0(root) ``` The Docker run uses `--network none`; network is only needed during image build to install packages and fetch the pinned GPSD source. ## Cleanup ```bash ./clean.sh ```