NASA’s AMMOS Instrument Toolkit Vulnerability Exposes Command Functions
A critical security vulnerability has been discovered in NASA’s open-source AMMOS Instrument Toolkit (AIT)-GUI ground software, which poses significant risks by potentially allowing unauthenticated attackers to issue commands to spacecraft and instruments, execute server-side scripts, and run command sequences. The implications of such a flaw are severe, considering the sensitivity and significance of the operations managed by NASA’s systems.
AIT-GUI serves as the browser-based operator console for NASA’s AMMOS Instrument Toolkit, an essential open-source framework designed to facilitate communication between ground data systems and instruments aboard spacecraft. This toolkit is key in ensuring that scientists and engineers can interact effectively with various space missions.
The identified flaw, tracked under the identifier GHSA-p9r8-2q67-fp86, carries a critical CVSS rating of 9.4. This alarming score illustrates the potential for severe impacts from exploitation. As of the latest updates, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned to this specific vulnerability.
Researcher Yuval Elbar from Cycode made the public disclosure of this alarming security finding on August 18, noting that the flaw affects all AIT-GUI versions up to and including 2.5.1. In response, a patch has since been released in version 2.5.2 of AIT-GUI, which addresses these vulnerabilities. While the prompt response from the development team is appreciated, the very existence of such a vulnerability raises concerns about the robustness of security measures in place for critical software utilized by a leading space agency.
Technical Overview of the Vulnerability
A critical aspect of this vulnerability lies in how AIT-GUI operates its web server, which is configured to initiate on all network interfaces rather than adhering to its designated host settings. This lack of respect for configuration settings can expose the system to unauthorized access. Additionally, the API fails to implement adequate measures such as authentication, authorization, and cross-site request forgery (CSRF) protection on endpoints that alter the state of the system.
The implications of the vulnerability are particularly concerning due to specific API routes. The /cmd route has the ability to relay commands to the command bus, while /script/run and /seq can execute scripts and command sequences. This configuration means that strings of commands can be sent to execute potentially dangerous operations. Furthermore, these endpoints expose a concerning risk as they construct filesystem paths using user-controlled input without proper confinement, allowing external files to be executed outside their intended directories.
The security weaknesses exposed by this vulnerability underscore the serious implications of access-control failures. Operational technology (OT) environments often reflect a similar vulnerability, where weak access management might provide attackers a pathway to execute high-impact functions.
Remarkably, the attack vector does not require direct network access to the AIT-GUI server. Due to the insufficient CSRF protection on state-altering routes, a compromised website that an operator interacts with can leverage their session to send unauthorized requests to the AIT-GUI service.
According to Cycode, the potential for exploitation is particularly evident when an operator interacts with a host-local or firewalled deployment. Such operators can unwittingly become targets through their web browsers, enabling cross-origin requests to be delivered without the necessary CORS preflight checks.
To mitigate these vulnerabilities effectively, the project team has recommended critical actions. These include implementing rigorous authentication and authorization protocols for state-changing endpoints, ensuring CSRF protection is in place, binding the server to its configured host settings, and applying path confinement to the affected routes.
Following this disclosure, Infosecurity Magazine has reached out to NASA/JPL for their insights on the matter and any steps they are taking to address the vulnerabilities identified. The response will provide additional context to this critical situation concerning the security of ground software that plays a crucial role in NASA’s space missions.
As the implications of such vulnerabilities can extend far beyond NASA, affecting broader aerospace and defense sectors, continued vigilance in cybersecurity practices remains mendatory. Addressing these vulnerabilities can help secure systems against unauthorized access and potential operational disruptions.