ait-core@2.5.2 vulnerabilities

ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions

Affected versions of this package are vulnerable to Arbitrary Command Execution via supplying a crafted YAML file.

There is no fixed version for ait-core.

ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') in the wait function. An attacker can execute arbitrary code by supplying a crafted string.

Note: Although the eval function is handy, it is inherently insecure. It is recommended to use third-party libraries that provide the same functionality but sanitise the input to handle expression evaluation securely.

There is no fixed version for ait-core.

ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions

Affected versions of this package are vulnerable to SQL Injection via the query_packets and insert functions. An attacker can execute arbitrary SQL commands by exploiting these vulnerabilities.

Note: Back-end database implementation also provides the insert function that handles the build of SQL query statements in a partially secure way by using the values (‘?’) separately and deferring the query build to the database library. The exact implementation approach is recommended for functions that build a SQL query string.

There is no fixed version for ait-core.

ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via a crafted packet. An attacker can execute arbitrary code by sending a maliciously crafted packet to the server.

Note: Although the eval function is handy, it is inherently insecure. It is recommended to use third-party libraries that provide the same functionality but sanitise the input to handle expression evaluation securely.

There is no fixed version for ait-core.

ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the Pickle function. An attacker can execute arbitrary commands by exploiting this vulnerability.

There is no fixed version for ait-core.

ait-core is a NASA JPL's Ground Data System toolkit for Instrument and CubeSat Missions

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the use of unencrypted channels to exchange data over the network. An attacker can execute arbitrary code by performing a man-in-the-middle attack.

Notes:

In the exploitation scenario, there two vulnerabilities:

1. ZMQ communication is unencrypted.

2. Use of Pickle

To prevent the RCE, it is recommended to resolve both issues. Although replacing the plain ZMQ communication with ZMQ SSH Tunnelling might be tempting, more is needed. It will mitigate the MitM attacks; however, given that the TLM instrument opens a port and connects to a telemetry source without any verification, another attack vector emerges for exploitation – in case the bad actor can access the telemetry source host, they can stop a telemetry source and start their own with a malicious payload.

There is no fixed version for ait-core.