NASA Ground Control Software Vulnerable to Unauthenticated Commands
Critical flaws in NASA's AIT-GUI ground control software allow unauthenticated attackers to send commands and scripts, potentially enabling unauthorized control over spacecraft systems.
A critical vulnerability has been discovered in NASA's open-source AMMOS Instrument Toolkit (AIT)-GUI ground software, potentially allowing unauthenticated attackers to issue spacecraft and instrument commands, execute server-side scripts, and run command sequences. This flaw, identified as GHSA-p9r8-2q67-fp86, carries a CVSS score of 9.4 and affects versions of AIT-GUI up to and including 2.5.1. No official CVE has been assigned at this time.
The AIT-GUI serves as the browser-based operator console for NASA's AMMOS Instrument Toolkit, a framework designed for ground data systems that facilitate communication with instruments and spacecraft. The vulnerability was disclosed by Cycode researcher Yuval Elbar on August 18, and a fix has since been released in AIT-GUI version 2.5.2.
The core of the vulnerability lies in how the AIT-GUI's web server operates. It incorrectly starts on all network interfaces instead of adhering to its configured host setting. Furthermore, the application's API lacks essential security measures such as authentication, authorization, and cross-site request forgery (CSRF) protection on endpoints that can alter system states.
Specifically, the /cmd route is capable of relaying commands directly to the command bus. The /script/run and /seq endpoints allow for the execution of scripts and command sequences, respectively. A significant concern with these latter two endpoints is their construction of filesystem paths based on user-controlled input without sufficient confinement, which could permit the execution of files outside of their intended directories.
The implications of these weaknesses are substantial, as these web functions act as an intermediary between the operator console and the critical command infrastructure. Failures in access control within exposed operational technology (OT) environments, such as this one, can easily escalate into pathways for high-impact functions, jeopardizing mission integrity.
Compounding the risk, the attack does not necessarily require direct network access to the AIT-GUI server. Because the state-changing API routes are susceptible to browser-compatible form submissions without CSRF protection, a malicious website visited by an authorized operator could initiate requests to the vulnerable service. Cycode demonstrated that an operator accessing a host-local or firewalled deployment could be targeted through their browser via cross-origin requests that bypass CORS preflight checks.
To address these security concerns, the AIT project recommends implementing authentication and authorization for all state-changing endpoints, incorporating CSRF protection, ensuring the web server binds only to its configured host, and enforcing strict path confinement for affected routes. Infosecurity Magazine has reached out to NASA/JPL for comment on the vulnerability and its potential impact.