Israeli Researcher Uncovers Critical CVSS 9.4 Vulnerability in NASA Control Software
An Israeli cybersecurity researcher uncovered a critical CVSS 9.4 vulnerability in NASA's open-source AIT-GUI space mission control software, caused by four development flaws enabling remote code execution.
In the world of software development, overlooking input sanitization or authentication checks is a daily occurrence. Usually, the worst outcome is a defaced home page or a leaked email list. But what happens when such lines of code slip directly into the control interface of NASA/JPL, the server responsible for monitoring spacecraft, transmitting commands, and synchronizing equipment across the galaxy?
In recent research, we began combing through the code of AIT-GUI, the web-based user interface for the AMMOS Instrument Toolkit. This open-source system is utilized by NASA engineers and operators to communicate with hardware during space missions. We did not anticipate uncovering a critical security vulnerability (GHSA-p9r8-2q67-fp86) that earned a near-maximum CVSS severity score of 9.4.
How Four Minor Flaws Create a Free Remote Code Execution Ticket
To understand the sensitivity of the situation, imagine a row of locked doors where developers simply forgot to install locks, leaving a sign reading Do Not Enter instead. No passwords, usernames, or special privileges were required. A combination of four minor development errors forged a lethal attack chain.
A server that said it listens to everyone: The code contained a host variable reading localhost from settings. Excellent, right? Except the developer initializing the server simply forgot to pass that variable.
host = getattr(self, "host", "localhost") # value is read, then never used
...
gevent.pywsgi.WSGIServer(
("0.0.0.0", port), # hardcoded: all interfaces
App, handler_class=WebSocketHandler,
)
The result: The server remained hardcoded to 0.0.0.0. The system operator assumes complete isolation on a local network, while the server is wide open to any incoming request from any IP address.
Zero basic defense mechanisms: The system lacked login procedures, CSRF tokens, or CORS restrictions. Worse yet, state-changing requests were dispatched in an application/x-www-form-urlencoded format, allowing Cross-Origin dispatch without prior validation. Put simply, if an operator merely visits an innocuous-looking website while working, that site can background-launch a silent request executing commands on their behalf.
An open line for command transmission (POST /cmd): The system exposed an endpoint allowing direct command transmissions to operational components. Devoid of protective layers or filters, the incoming form input was parsed and routed directly to the system Command Bus:
command = bottle.request.forms.get("command").strip()
args = command.split()
name = args[0].upper()
args = [util.toNumber(t, t) for t in args[1:]]
if self.send(name, *args): # the command is relayed to the bus
Sandbox escape (Path Traversal): The pièce de résistance emerged within the script execution component (POST /seq). The code concatenated user-supplied filenames directly to the root path without boundary checks:
bn_seqfile = bottle.request.forms.get("seqfile")
seqfile = os.path.join(SEQRoot, bn_seqfile)
# no confinement; only os.path.isfile
gevent.subprocess.Popen(["ait-seq-send", seqfile], ...)
The result: An attacker can inject relative path traversal strings such as '../../../../' to break out of the designated directory and execute arbitrary files or scripts on the server.
When a Researcher Meets AI Agents
One of the most fascinating aspects of discovery was our use of Agentic AI—autonomous AI-based code analysis agents. While human eyes easily overlook a minor variable defined but never passed onward, AI agents scanned data flows and rapidly linked tainted inputs to dramatic endpoint actions. The synergy between human cybersecurity intuition and AI code analysis at scale enabled us to decode the complete attack chain swiftly.
In accordance with responsible disclosure practices, we immediately contacted NASA development teams upon discovering the vulnerability. NASA responded rapidly, acknowledged the report, and patched the exposed components in the updated AIT-GUI 2.5.2 release.
You Cannot Rely on a Closed Environment
Today, the web and OT (Operational Technology) worlds overlap more than ever. While a compromised POST request in a standard application might culminate in corrupted database records, OT systems—especially space infrastructure—deal with commands sent to physical machinery, radically altering the blast radius.
Firewalls are no longer a viable security plan. One cannot rely on closed environments under the assumption that internal servers remain unreachable. Open-source code—even software written for NASA projects—must adopt a Zero Trust architecture from inception, complete with strict authentication mechanisms, granular access controls, and thorough input sanitization at the individual code level.
