NASA AIT‑GUI Vulnerabilities Allow Unauthenticated Attackers to Issue Spacecraft Commands
What Happened – Security researchers at Cycode disclosed a chain of flaws in AIT‑GUI, the browser‑based operator console for NASA/JPL’s open‑source AMMOS Instrument Toolkit (GHSA‑p9r8‑2q67‑fp86). The vulnerabilities receive a CVSS v3.1 score of 9.4 and enable an unauthenticated remote user to inject arbitrary commands onto the spacecraft and instrument command bus.
Why It Matters for Compliance & Audit Readiness
- The scenario maps directly to SOC 2 CC6.1 (System Operations) and CC7.1 (Risk Management) – controls that require documented vulnerability‑management and timely remediation.
- Continuous evidence of patching and monitoring is essential to demonstrate a defensible audit trail for mission‑critical software.
- Control‑mapping tools help translate a technical flaw into compliance artifacts that can be presented to auditors or regulators.
Who Is Affected – NASA/JPL, other government agencies, and aerospace/defense organizations that adopt the AMMOS toolkit or similar spacecraft command consoles.
Recommended Actions –
- Add AIT‑GUI to your asset inventory and initiate a formal vulnerability scan.
- Apply the vendor‑provided patches, then record remediation steps in your compliance platform.
- Deploy automated monitoring of the console’s HTTP endpoints to capture continuous evidence of control effectiveness. Source: The Hacker News
Technical Notes – The attack chain exploits unauthenticated HTTP request manipulation, bypassing input validation and authentication checks to reach the command bus. CVSS 9.4 (Critical). No data exfiltration reported, but the potential impact includes unauthorized spacecraft maneuvering. Source: The Hacker News