Summary
A missing-authentication vulnerability in the NASA-AMMOS AIT-Core telemetry and command broker allows unauthenticated network attackers to interact with the ZeroMQ message bus. If an attacker can reach the exposed broker sockets, they may inject spacecraft commands, read command and telemetry traffic, forge telemetry, or disrupt communications.
Affected context
The issue occurs in AIT-Core deployments where the ait-server ZeroMQ XSUB and XPUB sockets are reachable beyond a trusted local host or network segment. By default, the broker binds to all network interfaces without authentication or transport security, exposing command and telemetry topics on TCP ports 5559 and 5560. Risk depends on network reachability, broker configuration, and whether command messages are forwarded to an operational uplink.
Exploit preconditions
- Attack surface: Network-accessible ZeroMQ message-bus sockets
- Required access: No application authentication is required; the attacker needs network reachability to the exposed broker port
- Trigger point: Publishing messages to internal command topics or subscribing to command and telemetry topics
- Why exploitation is possible: The broker accepts and forwards messages without verifying the identity or authorization of the connecting client, while its default bindings may expose the service broadly
Why this happens
The underlying flaw is the absence of authentication and authorization on critical message-bus functions, mapping to CWE-306: Missing Authentication for Critical Function. The broker accepts publish and subscribe connections from reachable clients without establishing trust, authenticating their identity, or checking whether they are permitted to access sensitive topics. Binding the sockets to all interfaces without transport protection further expands the exposure boundary.
Potential impact
- An attacker may inject unauthorized spacecraft command data
- Sensitive command and telemetry traffic could be exfiltrated
- Forged telemetry may be introduced into downstream systems
- Command and telemetry processing could be disrupted
- Operational decisions could be influenced by manipulated data
- Compromised message-bus access could enable further attacks against connected systems
General mitigation guidance
Mitigation generally focuses on reducing message-bus exposure and enforcing authenticated, authorized communication.
Common defensive patterns include:
- Bind broker sockets to loopback or narrowly defined trusted interfaces by default
- Place the broker behind network segmentation and restrictive firewall policies
- Require client authentication and topic-level authorization
- Use encrypted transport with mutual identity verification where supported
- Separate command publication, telemetry subscription, and administrative privileges
- Disable unused broker endpoints and avoid exposing command paths directly to untrusted networks
- Run the broker with the minimum permissions and network access needed for its role
- Treat command and telemetry channels as high-impact assets requiring explicit access control
How teams detect issues like this
Detection can combine configuration review, network monitoring, and source analysis:
- Identify ZeroMQ XSUB or XPUB sockets bound to wildcard addresses such as all interfaces
- Scan for externally reachable broker ports and verify that exposure matches an approved trust boundary
- Review whether authentication, encryption, and topic-level authorization are enabled
- Inspect code and configuration for broker endpoints that accept unauthenticated publish or subscribe connections
- Monitor connection events, unusual topic subscriptions, unexpected publishers, and command traffic from unapproved sources
- Add policy checks to prevent unauthenticated critical message-bus endpoints from being deployed
- Use automated code and configuration review tools to flag wildcard bindings and missing access-control settings
