Critical Unauthenticated Command Execution Flaw in NASA/JPL’s Open‑Source AIT‑GUI (CVSS 9.4)
What Happened — Researchers at Cycode disclosed a critical vulnerability (GHSA‑p9r8‑2q67‑fp86, CVSS 9.4) in the AIT‑GUI component of NASA/JPL’s open‑source AMMOS Instrument Toolkit. The web console ships with no authentication, no session checks, and no CSRF protection, allowing anyone who can reach the exposed HTTP port to issue arbitrary spacecraft commands, run server‑side scripts, or execute command sequences.
Why It Matters for Compliance & Audit Readiness
- The flaw is a textbook example of missing access‑control and session‑management safeguards that SOC 2’s Security and Availability criteria require organizations to design, implement, and continuously monitor.
- Demonstrating that all production‑grade interfaces enforce authentication, least‑privilege access, and CSRF defenses provides concrete audit evidence that the “Logical Access” and “System Operations” controls are operating effectively.
- Continuous monitoring of configuration drift (e.g., accidental binding to 0.0.0.0) and automated evidence collection for access‑control policies are essential to prove ongoing compliance.
Who Is Affected — Aerospace & space‑mission operators, research institutions, and any organization that adopts the AMMOS toolkit for spacecraft or instrument control (industry: OTHER; vendor type: OTHER).
Recommended Actions
- Immediately upgrade to AIT‑GUI 2.5.2 or later, which adds authentication, session validation, and CSRF tokens.
- Conduct a SOC 2 access‑control gap analysis on all web‑based operator consoles; map findings to the Logical Access and System Operations criteria.
- Deploy continuous configuration‑monitoring tools that alert when services bind to 0.0.0.0 or when authentication mechanisms are disabled.
- Document the remediation steps and retain logs as audit evidence for the next SOC 2 assessment.
Source: Security Affairs
Technical Notes — The vulnerability stems from four chained web weaknesses: (1) binding the HTTP server to all interfaces, (2) missing authentication/session checks, (3) absent CSRF tokens, and (4) path‑traversal in script/sequence endpoints. Exploitation requires network reachability to the console port. Fixed in AIT‑GUI 2.5.2. Source: same as above