NASA/JPL’s open-source spacecraft command console lacked working authentication on its state-changing endpoints, letting anyone who reached the port issue commands, researchers found.
Cycode’s researchers dug into AIT-GUI, the browser-based operator console of NASA/JPL’s open-source AMMOS Instrument Toolkit, and found its web server bound to every network interface on port 8080, ignoring the configured host setting.
No login, session gate or CSRF protection guarded routes including POST /cmd, which passes input straight to the command bus. A session cookie is handed out to any request for the root page, so an attacker can obtain one without credentials and send commands on a second request. Two other endpoints built filesystem paths from raw input, enabling traversal outside script and sequence directories.
The advisory GHSA-p9r8-2q67-fp86 rates the chain critical at CVSS 9.4. No CVE has been assigned. Because the routes accept form-encoded bodies that browsers treat as simple requests, a webpage an operator merely visits can deliver a cross-origin POST without preflight, the researchers said.
Cycode framed the impact bluntly: an unauthenticated command results in issued instrument commands, not a defaced page. Researcher Yuval Elbar called the console a web GUI that listens on every interface, asks nobody for a password and can be steered by any page an operator opens.
The flaws were fixed in AIT-GUI 2.5.2, released in mid-August, which binds the configured host, rejects cross-origin state changes and confines script and sequence endpoints to their roots. Cycode urged operators to upgrade and keep the port off untrusted networks.
