NASA ground control software flaws allow unauthenticated commands

A critical vulnerability in NASA’s open-source AMMOS Instrument Toolkit (AIT)-GUI ground software could let unauthenticated attackers issue spacecraft commands, execute scripts, and run command sequences. The flaw, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS scale, affects versions through 2.5.1 and was fixed in 2.5.2.

Cycode researcher Yuval Elbar disclosed the issue on August 18. The web server listens on all network interfaces, and state-changing endpoints lack authentication, authorization, and CSRF protection. Attackers could also exploit path traversal in the /script/run and /seq endpoints.

Because the endpoints accept browser-compatible form submissions, an operator visiting a malicious website could be targeted even if the server is host-local or firewalled. NASA confirmed the fix and encouraged users to upgrade.