When the NASA Ground Station Has No Lock on the Door Unauthe...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://cycode.com/blog/ait-gui-unauthenticated-command-execution
• Blog Title: When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86)
• Suggested Section: Pentesting Web > CSRF (Cross Site Request Forgery), with cross-references from File Inclusion/Path Traversal and Web Vulnerabilities Methodology

🎯 Content Summary

AIT-GUI unauthenticated command execution (GHSA-p9r8-2q67-fp86) is a critical vulnerability chain affecting the browser-based operator console of NASA/JPL's open-source AMMOS Instrument Toolkit. AIT is a framework for building ground-data systems that communicate with instruments and spacecraft, send commands, and process returned telemetry. AIT-GUI exposes the operator functions used to send individual commands and start scripts or command sequences, so exploitation may affe...

🔧 Technical Details

Ignored network-binding configuration: Trace configuration values to the final socket or server-construction sink rather than assuming a setting is enforced. A service may read a loopback-oriented value such as host: localhost but discard it and pass 0.0.0.0 to the listener. This dead-write pattern silently turns an intended local service into a network-exposed service. Validate it through source review and by inspecting actual listening sockets at runtime.

Unauthenticated command-dispatch endpoints: Search for routes that mutate state or control external systems, then inspect their complete middleware and call paths for authentication and authorization. If attacker-controlled fields are parsed and passed to a command dispatcher such as self.send(name, *args), every command recognized by that dispatcher may become remotely invocable. Test with a harmless supported command and verify the result in app...

🤖 Agent Actions

Updated src/pentesting-web/csrf-cross-site-request-forgery.md.

Added:

• Unauthenticated browser-to-loopback/internal API abuse.
• Browser network position as ambient authority.
• Source-review hunting patterns and command-dispatch impact scoping.
• Generic preflight-free HTML form PoC.
• Headless-browser validation workflow.
• Current Local Network Access permission caveat.
• Numbered references to the primary GitHub advisory, Cycode blog, and Chrome documentation.

Validation passed:

• git diff --check
• Reference/citation consistency checks
• New links return HTTP 200
• Only the intended file changed

mdbook build was skipped because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://cycode.com/blog/ait-gui-unauthenticated-command-execution

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > CSRF (Cross Site Request Forgery), with cross-references from File Inclusion/Path Traversal and Web Vulnerabilities Methodology".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0