Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution

Security Affairsby @securityaffairs ()3 min read2 · 1 read
Read at securityaffairs.com
AI summary · glm-5.3-flashSummaries by Vani AI

NASA/JPL's AIT-GUI web console (CVSS 9.4) lacked authentication and CSRF protection, letting anyone send unauthenticated commands to spacecraft instruments; fixed in 2.5.2.

Cycode researchers found that AIT-GUI, the browser console of NASA/JPL's open-source AMMOS Instrument Toolkit, ran an HTTP server with no authentication, no session checks, and no CSRF protection on state-changing endpoints, allowing arbitrary commands to spacecraft instruments. The issue combines four weaknesses: binding to 0.0.0.0 regardless of configured host, missing authentication, missing CSRF defense, and path traversal in the /seq and /script/run endpoints. Tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, it is fixed in AIT-GUI 2.5.2. The findings came from AI-assisted code analysis confirmed with working proofs-of-concept, including a headless-browser CSRF demonstration.

Key facts
  • GHSA-p9r8-2q67-fp86 rated CVSS 9.4; unauthenticated command, script, and sequence endpoints.
  • Server ignores configured host and binds to 0.0.0.0, exposing the console network-wide.
  • CSRF lets a malicious website drive the console through an operator's browser, bypassing firewalls.
  • Path traversal on /seq and /script/run lets user input escape the intended directory.
  • Fixed in AIT-GUI 2.5.2; operators should upgrade and audit command history.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
ait-guiammosauthenticationcsrfjplnasaspacecraft
Vendors
NASAJet Propulsion LaboratoryCycode
Products
AIT-GUIAMMOS Instrument Toolkit
Organizations
NASAJet Propulsion LaboratoryCycode

From the original article

3 min read at securityaffairs.com

A critical flaw (CVSS 9. 4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.