Description

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. A path traversal in src/fprime_gds/flask/updown.py allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key (CWE-321) in the application enables session forgery. Chained together, these vulnerabilities allow complete compromise of the ground data system and any spacecraft under its control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:30.533Z",
  "pubdate": "2026-08-10T11:17:30.533Z",
  "executiveSummary": "Multiple critical vulnerabilities exist in NASA fprime-gds through version 3.4.3, exposing ground station hosts and connected spacecraft to severe risk.\nThe identified security flaws comprise a complete absence of authentication across all endpoints in the Flask application located at src/fprime_gds/flask/app.py, an arbitrary file read and write path traversal vulnerability in src/fprime_gds/flask/updown.py, and the use of a hardcoded secret key classified under CWE-321.\nAn unauthenticated remote attacker can exploit these weaknesses without privileged access to achieve arbitrary code execution on the underlying ground station host.\nFurthermore, the combination of these vulnerabilities allows session forgery via the hardcoded secret key and enables the injection of arbitrary commands directly into connected spacecraft.\nThe risk implications are catastrophic, resulting in a complete compromise of the ground data system and any spacecraft under its direct operational control.\nExploitation requires network access to the exposed Flask application, with no prior authentication or specialized privileges necessary.",
  "technicalDetails": "The vulnerabilities reside within the NASA fprime-gds application up to version 3.4.3, specifically targeting the web-based Ground Data System interface components.\nThe root cause of the access control failure is the complete lack of authentication enforcement within the Flask application at src/fprime_gds/flask/app.py, allowing any unauthenticated remote client to interact directly with all exposed application endpoints over the network.\nCompounding this lack of access control, src/fprime_gds/flask/updown.py contains a path traversal vulnerability that permits unauthorized reading and writing of arbitrary files residing outside the designated upload directory.\nAdditionally, the application utilizes a hardcoded secret key, matching CWE-321, which fundamentally undermines cryptographic session management and enables malicious actors to forge valid user sessions.\nThe step-by-step attack flow begins with an unauthenticated attacker leveraging the hardcoded secret key to forge a privileged session or directly interacting with unauthenticated endpoints.\nThe attacker then exploits the path traversal vulnerability in the file upload and download component to read or write arbitrary files on the ground station host filesystem, such as application source code, configuration files, or system binaries.\nBy manipulating files or abusing unprotected execution pathways within the application context, the attacker achieves arbitrary code execution on the ground station host.\nPost-exploitation impact extends beyond the local host, as the compromised ground data system interface allows the attacker to inject arbitrary commands directly into connected spacecraft, leading to a complete compromise of both ground and space segments."
}