EUVD-2026-53211
GHSA-x4pc-pqfq-54j2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N) low-complexity network request forges the admin role with no user interaction; admin access yields high confidentiality, integrity and availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura. By setting {"session_variables":{"x-hasura-role":"aerie_admin"}} in the body of a request to POST /command-expansion/put-expansion with no Authorization header, an unauthenticated attacker satisfies the role check and can insert arbitrary expansion rules into sequencing.expansion_rule, which govern how spacecraft activities are translated into commands. Separately, POST /put-dictionary is explicitly listed in the ENDPOINTS_WHITELIST and is exempt from any authentication, allowing unauthenticated writes of command dictionaries.
AnalysisAI
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The affected component is the sequencing-server of Aerie, NASA's Advanced Multi-Mission Operations System (AMMOS) planning and sequencing platform used to translate mission activity plans into spacecraft command sequences (CPE cpe:2.3:a:nasa-ammos:plandev_(sequencing-server)). Aerie fronts a Hasura GraphQL/Postgres backend, and Hasura's role-based access control relies on session variables such as x-hasura-role normally injected by a trusted auth webhook. The root cause is CWE-306 (Missing Authentication for Critical Function): getHasuraSession() in sequencing-server/src/app.ts prefers a client-supplied session_variables JSON object over the JWT claims in the Authorization header and performs no verification that the request actually came from Hasura, so the server treats attacker-controlled JSON as an authoritative identity assertion. The writes land in the sequencing.expansion_rule table, which defines activity-to-command expansion logic.
RemediationAI
No vendor-released patch identified at time of analysis; the only reference is the source repository https://github.com/NASA-AMMOS/plandev, which operators should monitor for a fixed release. As compensating controls, reconfigure or patch getHasuraSession() so the role is derived solely from verified JWT claims in the Authorization header and never from a client-supplied session_variables body, and require a shared secret (e.g., Hasura admin secret / webhook signature) to prove requests originate from Hasura-trade-off: requires a code change or middleware in front of the service. Remove POST /put-dictionary from ENDPOINTS_WHITELIST so it enforces authentication like other endpoints (trade-off: any legitimate automation calling it unauthenticated will break and must be updated to send credentials). Until fixed, place the sequencing-server behind a reverse proxy or network ACL that restricts access to trusted operator hosts and blocks requests to /command-expansion/put-expansion and /put-dictionary from untrusted sources (trade-off: may interfere with distributed planning workflows), and audit sequencing.expansion_rule and command dictionaries for unauthorized inserts.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today