A critical vulnerability in NASA's open-source AMMOS Instrument Toolkit (AIT)-GUI ground software has been found that could allow unauthenticated attackers to issue spacecraft and instrument commands, execute server-side scripts and run command sequences.

AIT-GUI is the browser-based operator console for NASA's AMMOS Instrument Toolkit, an open-source framework for ground data systems that communicate with instruments and spacecraft.

The flaw, tracked as GHSA-p9r8-2q67-fp86 and given a CVSS ratting of 9.4, affects AIT-GUI versions through 2.5.1. No CVE has been assigned at the time of writing.

Cycode researcher Yuval Elbar disclosed the findings on August 18 and the flaw has been fixed in AIT-GUI 2.5.2. 

Read more on spacecraft security: European Space Agency Confirms Server Breach

Unauthenticated API Exposes Command Functions

AIT-GUI starts its web server on all network interfaces rather than honoring its configured host setting. The API also has no authentication, authorization or cross-site request forgery (CSRF) protection on state-changing endpoints.

The /cmd route can relay commands to the command bus, while /script/run and /seq can execute scripts and command sequences. The latter two endpoints also construct filesystem paths from user-controlled input without adequate confinement, allowing files outside the intended directories to be passed for execution.

The combination is significant because these web functions sit between an operator console and command infrastructure. Security weaknesses in exposed operational technology (OT) environments can similarly turn basic access-control failures into routes to high-impact functions.

The attack does not necessarily require direct network access to the AIT-GUI server. Because the state-changing routes accept browser-compatible form submissions without CSRF protection, a malicious website visited by an operator can send requests to the service.

Cycode said it demonstrated that an operator accessing a host-local or firewalled deployment could therefore be targeted through their browser, with cross-origin requests delivered without a CORS preflight.

The project recommends authentication and authorization for state-changing endpoints, CSRF protection, binding the server to its configured host and path confinement for the affected routes.

Infosecurity Magazine has contacted NASA/JPL for comment and will update this article with any response.