GHSA-p9r8-2q67-fp86: NASA AIT-GUI Unauthenticated Command Injection — Detection and Remediation Guide

Security researchers at Cycode have disclosed a critical vulnerability chain in AIT-GUI — the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit (AIT) — that allows an unauthenticated remote attacker to issue arbitrary commands to the spacecraft and instrument command bus. The chain is tracked as GHSA-p9r8-2q67-fp86 and carries a CVSS v3.1 score of 9.4 (Critical).

Let that sink in from a defender's seat: this is not a web app bug that leaks session tokens. This is missing authentication on a command path that talks to flight software, ground station equipment, and test hardware. AIT-GUI is the console operators use to send telecommands and monitor telemetry for missions, instrument testbeds, and lab hardware. An attacker who reaches the interface can inject commands into that bus without credentials.

The exposure extends well beyond NASA itself. AMMOS is open source and is used across the space industry — aerospace contractors, university CubeSat programs, research labs, and commercial ground station operators all run AIT-derived stacks. If your organization operates any AIT-GUI instance reachable beyond a locked-down operations VLAN, you need to treat this as a patch-and-audit event this week, not this quarter.

Technical Analysis

Affected Software

• Product: AIT-GUI, the web-based operator console component of the AMMOS Instrument Toolkit (NASA/JPL open-source project)
• Advisory: GHSA-p9r8-2q67-fp86 (GitHub Security Advisory)
• Severity: CVSS v3.1 9.4 (Critical) — consistent with a network-reachable, unauthenticated issue with high integrity impact
• Disclosing researchers: Cycode
• Deployment contexts: Mission operations centers, instrument test labs, hardware-in-the-loop (HIL) testbeds, academic satellite programs, and any organization that self-hosts AIT components

Because AIT is a Python-based open-source toolkit commonly deployed via pip or directly from source, many installations are unmanaged — stood up by engineering teams outside IT's inventory. That is precisely the population most at risk here.

How the Flaw Chain Works (Defender's View)

The Cycode research describes a chain of flaws, not a single bug. The essential elements, from a defensive standpoint:

1. Missing authentication on the web console. AIT-GUI exposes an HTTP(S) interface with API endpoints that accept operator actions. The vulnerable versions do not enforce authentication or adequate authorization checks on the endpoints that drive command issuance.
2. Direct path to the command bus. AIT-GUI does not merely display telemetry — it serializes operator commands and forwards them onto the AIT command pipeline (typically ZeroMQ-based pub/sub plumbing between AIT components, and onward to ground station interfaces and hardware). An attacker who can reach the web tier can craft requests that result in arbitrary commands being emitted onto that bus.
3. No exploitation prerequisites beyond network access. No valid session, no stolen credential, no user interaction. The attack complexity is low: reach the listening port, send crafted requests, command the instrument.

In a lab or testbed, that means an attacker can drive hardware states, corrupt test campaigns, or damage equipment. In an operational context, it means unauthorized telecommand injection — the nightmare scenario for any ground segment.

Exploitation Status

• PoC/research disclosure: The flaw chain was publicly detailed by Cycode as part of a coordinated disclosure with the advisory.
• Active exploitation: As of this writing, there are no confirmed reports of in-the-wild exploitation, and the advisory has not been added to CISA's Known Exploited Vulnerabilities catalog.
• Practical risk: The barrier to weaponization is extremely low. Any internet-exposed or flat-network AIT-GUI instance should be presumed discoverable via Shodan/Censys and internal scanning. Treat exposed instances as effectively exploitable today.

Detection & Response

This is a technical threat, and detection here is less about catching a novel exploit and more about (a) finding where AIT-GUI is deployed and exposed, and (b) alerting on unauthenticated use of its command paths. Ground the detections in the observable behaviors: HTTP requests to the AIT-GUI web service, unauthenticated command API calls, and the AIT process initiating unexpected outbound connections to ground hardware.

Sigma Rules

---
title: Unauthenticated Command Request to NASA AIT-GUI Console
id: 3f8a1c72-5b94-4e61-a9d2-7c4e8f1a2b33
status: experimental
description: Detects HTTP POST requests to AIT-GUI command endpoints without an authenticated session, consistent with exploitation of GHSA-p9r8-2q67-fp86.
references:
  - https://github.com/advisories/GHSA-p9r8-2q67-fp86
  - https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/cmd'
      - '/command'
      - '/api/cmd'
      - '/api/command'
  filter_auth:
    cs-username:
      - '-'
      - ''
  condition: selection_method and filter_auth
falsepositives:
  - Legitimate scripted operator tooling calling the command API
  - Health-check or monitoring systems hitting API routes
level: high
---
title: AIT-GUI Web Service Initiating Outbound Connections to Ground Hardware
id: 8b2d4e91-6a3c-4f78-bd15-9e2c7a4f5d66
status: experimental
description: Detects the AIT-GUI/AMMOS Python process establishing network connections to ground station or instrument endpoints, which may indicate command bus injection or anomalous operator activity.
references:
  - https://github.com/advisories/GHSA-p9r8-2q67-fp86
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'python'
    CommandLine|contains:
      - 'ait'
      - 'ait_gui'
      - 'ait-gui'
  filter_localhost:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  condition: selection and not filter_localhost
falsepositives:
  - Normal AIT pipeline traffic between ground segment components (ZeroMQ pub/sub)
  - Telemetry uplink to known flight hardware interfaces
level: medium

KQL — Microsoft Sentinel / Defender

The first query hunts proxy/firewall/WAF telemetry for unauthenticated POSTs to AIT command endpoints. The second identifies AIT-GUI processes making outbound network connections from endpoint telemetry.

// Hunt: unauthenticated POSTs to AIT-GUI command endpoints via proxy/WAF/firewall logs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestMethod == "POST"
| where RequestURL has_any ("/cmd", "/command", "/api/cmd", "/api/command")
| where isempty(RequestContext) or RequestContext has "unauthenticated"
| project TimeGenerated, SourceIP, DestinationHostName, DestinationPort, RequestURL, RequestMethod, DeviceAction
| order by TimeGenerated desc
;
// Hunt: AIT-GUI process initiating outbound connections (CEF/Syslog or Defender for Endpoint on Linux)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessCommandLine has_any ("ait_gui", "ait-gui", " ait ")
    or InitiatingProcessFolderPath has "ait"
| where not(RemoteIP startswith "127.")
| summarize Connections = count(), RemoteEndpoints = make_set(RemoteIP, 20), Ports = make_set(RemotePort, 20)
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by Connections desc

Velociraptor VQL

Use this artifact to sweep Linux operations hosts for running AIT-GUI instances and their live network connections — this doubles as both a compromise-assessment hunt and an asset-discovery exercise, which is arguably the bigger problem here.

-- Identify running AIT-GUI / AMMOS processes and their network connections
-- Relevant to GHSA-p9r8-2q67-fp86 exposure assessment
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)ait[-_ ]?gui|ammos|ait_server|ait-seq|ait-cmd'
   OR Exe =~ '(?i)ait'

-- Enumerate listening sockets bound by Python processes on ground segment hosts
-- AIT-GUI default deployments listen on HTTP without hardening
SELECT Pid, Name, CommandLine, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ 'python'
  AND Status =~ 'LISTEN'

Remediation / Verification Script

Run this on ground-segment Linux hosts to inventory AIT installations, identify the running console, check its listening exposure, and confirm the installed package version against the patched release in the advisory.

#!/bin/bash
# GHSA-p9r8-2q67-fp86 - AIT-GUI exposure and version assessment
set -euo pipefail

echo "=== [1] Installed AMMOS/AIT packages ==="
pip3 list 2>/dev/null | grep -Ei 'ait|ammos' || echo "No AIT packages found via pip"

echo ""
echo "=== [2] Running AIT-related processes ==="
ps aux | grep -Ei 'ait[-_]?gui|ammos|ait_server' | grep -v grep || echo "No AIT processes running"

echo ""
echo "=== [3] AIT-GUI listening exposure (flag anything bound to 0.0.0.0 or non-loopback) ==="
ss -tlnp 2>/dev/null | grep -i python || echo "No Python listeners detected"

echo ""
echo "=== [4] Local AIT source checkouts ==="
find /opt /srv /home -maxdepth 4 -type d -iname '*ait*' 2>/dev/null | head -20 || true

echo ""
echo "=== [5] Firewall check: is the AIT-GUI port reachable from outside? ==="
echo "Manually verify: nft list ruleset | grep -i <ait-gui-port>"
echo "Then upgrade: pip3 install --upgrade ait-gui   # confirm against GHSA-p9r8-2q67-fp86 fixed versions"

Remediation

1. Upgrade AIT-GUI immediately. Pull the fixed release referenced in GHSA-p9r8-2q67-fp86 and the NASA-AMMOS/AIT-GUI repository. If you deployed from source, re-pull and rebuild — do not assume a pip-managed instance tracks the advisory automatically. Verify the running version post-upgrade.

2. If you cannot patch today, remove network reachability. This is the most effective compensating control for an unauthenticated flaw:

• Bind AIT-GUI to loopback or the operations VLAN only; never 0.0.0.0 on a routable segment.
• Place the console behind an authenticating reverse proxy (e.g., mTLS or SSO-aware proxy) so the unauthenticated endpoint is never directly exposed.
• Enforce host and network firewall rules that restrict inbound access to a named operator subnet.

3. Inventory what you actually run. AIT is open source and frequently deployed by engineering teams without IT's knowledge. Sweep your networks (including lab and testbed segments) for the AIT-GUI listening service, and check Shodan/Censys for any instance of yours visible from the internet. An unknown instance is an unpatched instance.

4. Segment the command path. The reason this flaw is catastrophic is the flat trust between the web console and the command bus. Architecturally, telecommand issuance should sit behind a separate control boundary from telemetry viewing: dedicated jump hosts, separate service accounts, and explicit authorization gates before anything reaches the spacecraft or instrument interface. ZeroMQ plumbing between AIT components should be on isolated segments with strict peer allowlists.

5. Audit for prior abuse. Before and after patching, review web access logs for the AIT-GUI host for unauthenticated POSTs to command routes (the Sigma and KQL above are your starting points). Given the public disclosure and trivial exploitability, assume scanning started the day the advisory dropped.

6. Add command-path logging where the vendor can't. Because AIT-GUI's own logging may be thin, capture at the proxy layer: log every request to command endpoints with source identity, and alert on any command issuance outside scheduled operations windows. In space ground segments, command activity is rare and scheduled — anomaly detection here is unusually easy and unusually high-fidelity.

There is no CISA KEV mandate attached to this advisory as of publication, but a 9.4 CVSS unauthenticated flaw on a command-and-control path for physical systems does not need a deadline to justify emergency change treatment. If this console touches anything that flies, drives, heats, or powers — patch it now.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub