Security researchers at Cycode have discovered a critical vulnerability in NASA software that could allow attackers to control connected satellites and space instruments.
The bug was identified in AIT-GUI, a web interface for the AMMOS Instrument Toolkit developed jointly by NASA and the Jet Propulsion Laboratory. Tracked as GHSA-p9r8-2q67-fp86, the vulnerability was assigned a score of 9.4 out of 10 under the Common Vulnerability Scoring System, classifying it as a critical security threat.
The AMMOS Instrument Toolkit is utilized across ground space infrastructure to manage spacecraft, issue commands to scientific payloads, and process incoming telemetry data from orbit. Telemetry provides ground controllers with vital measurements and diagnostic status updates from active space missions. The Jet Propulsion Laboratory, based in Pasadena, California, is a federally funded research center that manages robotic planetary exploration for the National Aeronautics and Space Administration.
Multiple security vulnerabilities identified
According to researchers at Cycode, the AIT-GUI interface contained several major architectural security weaknesses simultaneously. The application required no user authentication, enforced no role-based access controls, lacked protection against cross-site request forgery attacks, and accepted network connections across all interfaces by default.
In cross-site request forgery attacks, a malicious site tricks a victim's browser into sending unauthorized requests to another service. Researchers noted that an attacker would not need to breach the server directly. Instead, convincing a ground operator to open a specially crafted web page would cause the victim's browser to send requests to the local AIT-GUI installation automatically.
In the most severe attack scenario, an unauthorized user could transmit arbitrary commands into the central command bus of an active satellite or scientific instrument. Specialists also discovered that attackers could run arbitrary scripts and execution commands directly on the underlying server host.
Network safeguards and patch release
Specialists emphasized that the practical severity of the vulnerability depends heavily on how the software is configured and deployed in practice. To interact with spacecraft directly, the vulnerable web interface must be connected to primary mission command infrastructure, while additional network segmentation and organizational security controls can prevent external intrusion.
NASA and developers have resolved the flaw with the release of AIT-GUI version 2.5.2. Organizations using earlier versions of the software have been advised to apply the security update immediately to protect mission systems.
