NASA Ground Control Flaw Allowed Unauthenticated Spacecraft Commands

Security researchers at Cycode have uncovered a critical vulnerability chain in AIT-GUI, the browser-based operator console used within NASA and JPL's open-source AMMOS Instrument Toolkit. The flaws could allow unauthenticated attackers to issue arbitrary commands to spacecraft and scientific instruments, execute server-side scripts, and run complex command sequences.

The vulnerability, tracked as GHSA-p9r8-2q67-fp86, carries a severe CVSS v3.1 score of 9.4. The flaw stems from a combination of security failures, including a hardcoded 0.0.0.0 bind that ignores configured hosts, a total lack of authentication and authorization, and missing Cross-Site Request Forgery (CSRF) protections on state-changing endpoints. Specifically, attackers could utilize `POST /cmd` for arbitrary commands, `POST /script/run` for server-side scripts, and `POST /seq` for command sequences. The latter two endpoints were also found to be susceptible to path traversal (CWE-22).

The Role of AMMOS

To understand the risk, it is necessary to look at the AMMOS (Advanced Multi-Mission Operations System) Instrument Toolkit. This NASA/JPL framework is designed to build ground data systems that serve as the primary link between Earth and space. These systems are responsible for sending critical operational commands to spacecraft and instruments while processing the telemetry data returned from those assets. AIT-GUI acts as the human-machine interface, providing the browser-based console that operators use to manage these high-stakes interactions.

Operational Technology Risks

This discovery highlights a critical failure in access control for operational technology (OT). Unlike standard IT vulnerabilities that result in data theft or website defacement, the impact here is physical. Because the software controls actual space assets, the potential for unauthorized manipulation is significant. In this context, the blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages.

Furthermore, the vulnerability is exploitable via CSRF. This means a malicious website visited by a legitimate operator could trigger commands on the AIT-GUI console, even if the deployment is protected by a firewall or restricted to a local host.

Remediation and Status

The vulnerability affects AIT-GUI versions 2.5.1 and earlier. NASA and the project maintainers have addressed the issue in version 2.5.2. Organizations utilizing the AMMOS Instrument Toolkit are urged to update their consoles immediately to prevent unauthorized access to ground control functions. While the software is open-source, the critical nature of the assets it controls makes the immediate application of the patch essential for mission security.