Authorization Bypass in Aerie PlanDev Sequencing Server

Executive Summary

This vulnerability allows an unauthenticated attacker to bypass authorization checks in the Aerie/PlanDev sequencing-server by injecting a fake admin role via the request body. The server prioritizes client-supplied session variables over JWT claims, enabling unauthorized writes to expansion rules and command dictionaries.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized POST requests to /command-expansion/put-expansion or /put-dictionary endpoints without valid Authorization headers. Inspect request bodies for session_variables containing x-hasura-role set to admin or other elevated roles.

Useful 0 Not Useful 0

Impact Analysis

An attacker could insert malicious expansion rules to alter spacecraft command sequences, potentially causing incorrect or dangerous operations. They could also modify command dictionaries to change how activities are translated into commands, leading to system failures or safety hazards.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and access control, such as GDPR's security principles or HIPAA's safeguards for protected health information, by allowing unauthorized modifications to critical system configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict access to the affected endpoints. Implement strict validation of Authorization headers and reject requests with session_variables in the body. Update middleware to prioritize JWT claims over client-supplied session variables.

Useful 0 Not Useful 0