Nasa Ammos
Monthly
Missing authentication in the NASA-AMMOS ANMS reference implementation exposes the amp-manager REST API (CivetWeb, port 8089) directly on the host network, allowing any network-reachable client to command DTNMA agents without credentials. Because the shipped docker-compose.yml publishes the port and bypasses the CAM authentication gateway, unauthenticated remote attackers can enumerate agents, submit arbitrary EXECSET command sets to them, and clear stored reports. No public exploit identified at time of analysis; the flaw affects the reference/testbed implementation rather than onboard spacecraft flight software, though managed agents may represent real ground or space nodes depending on deployment.
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated API access in NASA AMMOS Instrument Toolkit (AIT) Deep Space Network Interface before 2.2.2 lets remote attackers control spacecraft communication sessions with no credentials. Seven Space Link Extension (SLE) interface-manager routes are exposed without any authentication, allowing an attacker to start or stop Deep Space Network sessions, read telemetry frame data, and inject arbitrary frames into active spacecraft links. Reported by VulnCheck and rated CVSS 4.0 9.3; no public exploit is identified at time of analysis, but the missing-auth flaw is trivially reachable over the network.
Missing authentication in NASA-AMMOS AIT-GUI before 2.5.1 lets any unauthenticated network attacker mint a valid session via Sessions.create() and then push arbitrary commands onto the spacecraft command bus through handle_cmd(). Because no credential check gates session creation and no authorization gate sits between session issuance and command dispatch, a remote attacker can issue arbitrary spacecraft commands. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authentication in the NASA-AMMOS ANMS reference implementation exposes the amp-manager REST API (CivetWeb, port 8089) directly on the host network, allowing any network-reachable client to command DTNMA agents without credentials. Because the shipped docker-compose.yml publishes the port and bypasses the CAM authentication gateway, unauthenticated remote attackers can enumerate agents, submit arbitrary EXECSET command sets to them, and clear stored reports. No public exploit identified at time of analysis; the flaw affects the reference/testbed implementation rather than onboard spacecraft flight software, though managed agents may represent real ground or space nodes depending on deployment.
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated API access in NASA AMMOS Instrument Toolkit (AIT) Deep Space Network Interface before 2.2.2 lets remote attackers control spacecraft communication sessions with no credentials. Seven Space Link Extension (SLE) interface-manager routes are exposed without any authentication, allowing an attacker to start or stop Deep Space Network sessions, read telemetry frame data, and inject arbitrary frames into active spacecraft links. Reported by VulnCheck and rated CVSS 4.0 9.3; no public exploit is identified at time of analysis, but the missing-auth flaw is trivially reachable over the network.
Missing authentication in NASA-AMMOS AIT-GUI before 2.5.1 lets any unauthenticated network attacker mint a valid session via Sessions.create() and then push arbitrary commands onto the spacecraft command bus through handle_cmd(). Because no credential check gates session creation and no authorization gate sits between session issuance and command dispatch, a remote attacker can issue arbitrary spacecraft commands. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.