NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrumen…
Intelligence analysis by Llama
A vulnerability in AIT-GUI, a browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, allows an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The vulnerability has been addressed in version 2.5.2.
Imagine you're an astronaut controlling a spacecraft from a computer. If someone can hack into that computer, they can send fake commands to the spacecraft, which could be very bad. This is what happened with AIT-GUI, a tool that lets people control spacecraft and instruments. A hacker could send fake commands to the spacecraft without needing a password.
Analysis
AIT-GUI and the AMMOS Instrument Toolkit
The AMMOS Instrument Toolkit is a framework for building ground data systems, which sends commands to instruments and spacecraft and processes the telemetry coming back down. AIT-GUI is its operator console, and the endpoints in question relay operator commands to a command bus.
The Vulnerability
The vulnerability in AIT-GUI allows an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. This is because the AIT-GUI web server reads its configured host value and then discards it, binding the listener to the hardcoded address 0.0.0.0 on port 8080 by default, and exposes every state-changing route with no authentication, no authorization, and no cross-site request forgery (CSRF) protection.
Impact
An unauthenticated party who can reach the port can do the following:
- Issue arbitrary instrument and spacecraft commands via POST /cmd
- Execute server-side scripts via POST /script/run, including files outside the intended directory via path traversal
- Run command sequences via POST /seq, including out-of-directory files passed to a subprocess
Fix
The vulnerability has been addressed in version 2.5.2, which binds the configured host, adds a before_request hook that compares a request's Origin or Referer against the server's own Host for POST, PUT, DELETE, and PATCH, and confines /script/run and /seq to their configured roots.
Key points
- A vulnerability in AIT-GUI allows an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus.
- The vulnerability has been addressed in version 2.5.2.
- The fix binds the configured host, adds a before_request hook, and confines /script/run and /seq to their configured roots.
If the vulnerability is addressed and the tool is updated, the risk of hackers exploiting this flaw will decrease, and the spacecraft and instruments will be safer.
However, if the vulnerability is not addressed or the tool is not updated, hackers could continue to exploit this flaw, potentially causing damage to the spacecraft and instruments.
