Overview
Security researchers at Cycode have disclosed a chain of vulnerabilities in AIT-GUI, the browser-based operator console for NASA and JPL's open-source AMMOS Instrument Toolkit (AIT). The flaws allow an unauthenticated attacker to reach the toolkit's spacecraft and instrument command bus and issue arbitrary commands — a finding with serious implications for missions that rely on AIT for ground station operations.
AIT (formerly known as BLISS) is part of NASA's AMMOS (Advanced Multi-Mission Operations System) and is widely used in the aerospace community as an open-source foundation for mission operations software. It provides telemetry monitoring, commanding, and data visualization for spacecraft and instruments.
The Vulnerability Chain
Cycode's researchers identified a chain of weaknesses in AIT-GUI — the web-based frontend that operators use to monitor and command spacecraft and science instruments. The chain operates without requiring authentication, making it exploitable by any attacker with network access to the AIT-GUI server.
Key Weaknesses Identified
1. Missing Authentication on Command Endpoints
AIT-GUI exposes WebSocket or HTTP endpoints for sending commands to the underlying command bus. Researchers found that these endpoints lack authentication controls, meaning any client that can reach the server can interact with the command interface without credentials.
2. Command Injection via the Command Bus
Once access to the command endpoint is obtained, insufficient input validation allows an attacker to inject arbitrary commands. The command bus acts as the intermediary between the GUI and the spacecraft or instrument hardware — commands placed on the bus are transmitted to the target system.
3. Chained Exploitation Path
The chain exploits these weaknesses in sequence: discover or reach the AIT-GUI instance, connect to the unauthenticated command interface, and inject malformed or malicious commands. Together, these steps require no authenticated session and no prior access to the system.
Impact
In an operational mission context, successful exploitation could allow an attacker to:
- Issue unauthorized commands to a spacecraft's command and data handling (C&DH) system
- Disrupt instrument operations, potentially corrupting science data collection
- Send commands that affect spacecraft attitude, power, or communication systems
- In worst-case scenarios, trigger modes that could endanger the spacecraft
While AIT is primarily used in research and development environments, some missions use AIT components in ground-truth operational pipelines. The open-source nature of the toolkit means it may also be deployed in configurations that expose AIT-GUI to broader networks than intended.
Affected Software
- AMMOS Instrument Toolkit (AIT) — AIT-GUI component
- Open-source, available on GitHub under the NASA/AMMOS organization
NASA and JPL Response
Cycode disclosed the vulnerabilities responsibly to NASA and JPL prior to publishing their research. The disclosure process followed coordinated vulnerability disclosure practices. Users of AIT should review the project's GitHub repository and security advisories for patched releases and recommended mitigations.
Recommendations for AIT Operators
- Restrict network access to AIT-GUI — it should never be exposed to untrusted networks or the public internet. Restrict to a dedicated, firewalled mission operations network.
- Apply patches from the AIT project repository once available.
- Add authentication to AIT-GUI if operating in any environment with untrusted users on the local network. Consider adding a reverse proxy with authentication in front of the GUI.
- Monitor command logs for unexpected command traffic on the command bus.
- Audit deployments to ensure AIT is only accessible from authorized ground station workstations.
Broader Context
This disclosure highlights an important and often overlooked area of cybersecurity: space operations software security. As more missions, commercial space companies, and academic institutions rely on open-source ground station software, the attack surface of space infrastructure grows. Security researchers like Cycode examining these systems before adversaries do is a valuable service to the aerospace community.