A vulnerability in the open-source ground-control software developed by NASA’s Jet Propulsion Laboratory (JPL) has been found to allow unauthenticated attackers to send commands to connected spacecraft or scientific instruments in an exposed deployment.
The flaw was first disclosed by security researcher Yuval Elbar in a report published by Cycode.
The vulnerability, tracked as GHSA-p9r8-2q67-fp86, received a CVSS score of 9.4, though no CVE has been assigned yet.
It affects AIT-GUI, the browser-based interface for NASA/JPL’s open-source AMMOS Instrument Toolkit, through version 2.5.1. AIT is a Python-based software suite used by space mission engineers to build ground data systems, prepare, execute and send commands to spacecraft, and process incoming telemetry data.
Elbar found that state-changing AIT-GUI endpoints lacked authentication, authorization and cross-site request forgery protection. An attacker who can connect to a server running the vulnerable software could thus submit requests without valid credentials.
In addition, a malicious website opened by an operator could cause their browser to send unauthorized requests to AIT-GUI, even if the interface is hosted locally or protected by a firewall.
Three Endpoints, No Credentials Needed
Elbar showed that one endpoint, POST /cmd, could be used to send arbitrary commands. Two others, POST /script/run and POST /seq, would allow attackers to run server-side scripts and execute command sequences, respectively.
The researcher also identified path-traversal weaknesses in the latter two that could cause the software to resolve file paths outside the intended script and sequence directories.
The risks associated with the flaw are greater when considering that AIT-GUI’s web server accepts connections via all the host computer’s network interfaces, as it is bound to 0.0.0.0, even if an operator selected more restrictive settings.
The interface could thus be reached from other devices on the network and, depending on firewall and routing configurations, from the internet through the default port 8080.
The vulnerability was fixed in AIT-GUI version 2.5.2. Cycode advised users to upgrade to the corrected release, ensure that the software is not reachable from untrusted networks, and treat any prior exposure as reason to review command and sequence history.
Expert Insights contacted JPL for comment but had not received a response at the time of writing.
So far, no real-world exploitation, compromised spacecraft or affected missions have been publicly reported.
