Plandev Sequencing Server
Monthly
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server allows unauthenticated remote attackers to impersonate the aerie_admin role because the authorization middleware trusts a session_variables object supplied in the request body over the Authorization header JWT. An attacker who submits {"session_variables":{"x-hasura-role":"aerie_admin"}} to POST /command-expansion/put-expansion can insert arbitrary expansion rules that govern how spacecraft activities are translated into commands, and POST /put-dictionary is separately whitelisted for unauthenticated writes. Rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.