Technical impact
The authorization middleware in NASA-AMMOS PlanDev's sequencing-server incorrectly prefers a session_variables object supplied in the request body over the JWT claims in the Authorization header, without verifying the origin of the request. An unauthenticated attacker can craft a POST request to /command-expansion/put-expansion with a body containing {\"session_variables\":{\"x-hasura-role\":\"aerie_admin\"}} and no Authorization header, thereby passing the role check and inserting arbitrary expansion rules into the sequencing.expansion_rule table. These rules dictate how spacecraft activities are translated into command sequences, effectively enabling the attacker to dictate commands executed by the spacecraft. Additionally, the /put-dictionary endpoint is whitelisted and exempt from authentication, so attackers can also write arbitrary command dictionaries without any credentials.
Affected Systems
NASA-AMMOS PlanDev sequencing-server. No specific version information is listed; all releases of the sequencing-server component are susceptible.
Risk and Exploitability
The vulnerability is rated CVSS 9.8, indicating a critical severity. The EPSS score of <1% indicates a low probability of exploitation, reflecting that real-world attacks are rare but can occur if the server is exposed to untrusted networks. The vulnerability is not listed in CISA KEV, yet its impact on spacecraft command integrity is potentially catastrophic. The likely attack vector is a remote HTTP request to the exposed POST endpoints, requiring no special infrastructure beyond network connectivity to the sequencing-server.
