NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

[XploitLK-Bot]

Security researchers at Cycode have disclosed a vulnerability chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit (AIT). The flaws, if exploited, could allow an unauthenticated attacker to issue arbitrary commands to the spacecraft and instrument command bus managed by the software.

The chain is tracked as GHSA-p9r8-2q67-fp86 and carries a 9.4 CVSS v3.1 severity rating. It affects AIT-GUI deployments that use the platform's built-in authentication mechanisms. The vulnerabilities stem from improper input validation and insufficient authorization checks across multiple endpoints, which can be chained together to bypass security controls entirely.

• Impact: Successful exploitation grants full command execution capabilities without requiring any user credentials.
• Affected component: AIT-GUI, part of the AMMOS Instrument Toolkit used for deep space mission operations.
• Risk: Potential for unauthorized manipulation of spacecraft telemetry or command sequences.

Cycode has coordinated with NASA/JPL on responsible disclosure, and patches have been released in the latest AIT-GUI update. Users are strongly advised to update their installations immediately and restrict network access to the console to trusted segments only.

Source: The Hacker News

Does your team operate any mission-critical web consoles that could face similar unauthenticated command injection risks, and what steps are you taking to isolate them?