The authorization middleware in NASA-AMMOS PlanDev's sequencing-server incorrectly prefers a session_variables object supplied in the request body over the JWT claims in the Authorization header, without verifying the origin of the request. An unauthenticated attacker can craft a POST request to /command-expansion/put-expansion with a body containing {"session_variables":{"x-hasura-role":"aerie_admin"}} and no Authorization header, thereby passing the role check and inserting arbitrary expansion rules into the sequencing.expansion_rule table. These rules dictate how spacecraft activities are translated into command sequences, effectively enabling the attacker to dictate commands executed by the spacecraft. Additionally, the /put-dictionary endpoint is whitelisted and exempt from authentication, so attackers can also write arbitrary command dictionaries without any credentials.

NASA-AMMOS PlanDev sequencing-server. No specific version information is listed; all releases of the sequencing-server component are susceptible.

The vulnerability is rated CVSS 9.8, indicating a critical severity. EPSS data is unavailable, but the lack of an authentication mechanism for the vulnerable endpoints implies a high likelihood of exploitation once the server is exposed to untrusted networks. The vulnerability is not listed in CISA KEV, yet its impact on spacecraft command integrity is potentially catastrophic. The likely attack vector is a remote HTTP request to the exposed POST endpoints, requiring no special infrastructure beyond network connectivity to the sequencing-server.