Unauthenticated Remote Code Execution in NASA fprime-gds

Executive Summary

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow unauthenticated remote attackers to execute arbitrary code on the ground station host and inject commands into connected spacecraft. The Flask application lacks authentication for all endpoints. A path traversal flaw enables reading and writing files outside the upload directory. A hardcoded secret key allows session forgery. Combined, these flaws enable full compromise of the ground data system and any spacecraft it controls.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated access to the Flask endpoints in fprime-gds. Inspect network traffic for unprotected HTTP requests to the GDS server. Verify if any endpoints lack authentication by reviewing the Flask application configuration in src/fprime_gds/flask/app.py.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to take control of the ground station system, execute malicious code, and send unauthorized commands to spacecraft. If you use or manage fprime-gds, your system could be hijacked, leading to data breaches, system damage, or loss of spacecraft control. Unauthorized access could disrupt operations or cause safety risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA due to unauthorized access risks, potential data breaches, and lack of proper authentication. GDPR requires protecting personal data, while HIPAA mandates secure access controls. The flaws in fprime-gds could lead to non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade fprime-gds to a patched version beyond 3.4.3. Disable all unauthenticated endpoints in the Flask application and remove the hardcoded secret key. Restrict network access to the GDS system to trusted sources only.

Useful 0 Not Useful 0