Ethical Hacking News
A critical flaw has been discovered in NASA/JPL's AIT-GUI software, which allows unauthenticated command execution. The vulnerability has been rated at a critical severity of 9.4 and has the potential to give hackers control over spacecraft instruments. NASA/JPL has released an updated version of the software to fix the issue, but operators and maintainers are advised to take steps to prevent exploitation.
A critical vulnerability has been discovered in NASA/JPL's AIT-GUI software, rated at 9.4 for critical severity. The vulnerability allows anyone to send unauthenticated commands to spacecraft instruments, giving hackers control over the spacecraft. The flaw is attributed to four web weaknesses, including lack of authentication, session checks, and CSRF protection. The vulnerability can be exploited by opening a malicious link in the same browser used to access the console. NASA/JPL has released an updated version of the AIT-GUI software to fix the vulnerability. Operators are advised to upgrade immediately and maintainors to add authentication and CSRF protection.
A critical vulnerability has been discovered in NASA/JPL's AIT-GUI software, which is used to control and operate spacecraft instruments. The flaw, tracked as GHSA-p9r8-2q67-fp86, has been rated at a critical severity of 9.4, indicating a high risk of exploitation. The vulnerability allows anyone to send unauthenticated commands to spacecraft instruments, effectively giving hackers control over the spacecraft.
The vulnerability is attributed to a combination of four web weaknesses in the AIT-GUI software, including the lack of authentication, session checks, and CSRF protection on state-changing endpoints. This means that an attacker can send malicious commands to the spacecraft by opening a malicious link in the same browser used to access the console, without needing direct access to the system or network port.
The AIT-GUI software is used by NASA/JPL and other missions to control and operate spacecraft and instruments, send commands, and process the data sent back. The software is used in real-time to control the spacecraft, making it a critical component of the mission.
The vulnerability was discovered by Cycode researchers, who used a combination of AI-assisted code analysis and human validation to find and confirm the issues. The researchers found that the AIT-GUI software starts an HTTP server with no authentication, no authorization, and no CSRF protection on any of its state-changing endpoints.
The vulnerability is particularly concerning because it allows hackers to execute arbitrary commands on the spacecraft, which could have significant consequences for the mission. The researchers noted that the vulnerability is not just a matter of authentication, but also includes issues with input confinement and CSRF protection.
To fix the vulnerability, NASA/JPL has released an updated version of the AIT-GUI software, which includes authentication and CSRF protection on state-changing endpoints. The update also includes a fix for the server binding to the configured host instead of 0.0.0.0, which allows the server to be exposed to the entire reachable network.
Operators are advised to upgrade immediately and verify that the console port is not reachable from untrusted networks. Maintainers are also advised to add authentication and CSRF protection to the command, script, and sequence routes, and to apply the existing path-confinement logic from /scripts/load to /seq and /script/run.
The discovery of this vulnerability highlights the importance of secure coding practices and the need for continuous monitoring and testing of software. It also underscores the critical role that NASA/JPL plays in the development and operation of spacecraft and instrumentation, and the need for vigilance and attention to detail in the development and maintenance of software.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Flaw-in-NASAJPLs-AIT-GUI-Software-Allows-Unauthenticated-Command-Execution-Leaving-Spacecraft-and-Instrumentation-Vulnerable-to-Attack-ehn.shtml
https://securityaffairs.com/197689/hacking/critical-flaw-in-nasa-jpl-open-source-spacecraft-command-software.html
Published: Sat Aug 22 03:37:33 2026 by llama3.2 3B Q4_K_M
