A critical authentication bypass in the NASA-AMMOS plandev sequencing-server allows unauthenticated attackers to inject arbitrary expansion rules and modify command dictionaries.

The application incorrectly trusts client-supplied JSON request bodies to derive authorization roles, bypassing the intended JWT-based authentication. This allows unauthenticated users to impersonate administrative roles and perform unauthorized writes to command expansion rules and dictionaries.

This vulnerability carries a CVSS score of 9.8 and allows for the manipulation of sequencing rules that govern spacecraft activities. Unauthorized modification of these rules or command dictionaries could result in significant operational disruption, data integrity loss, and potential safety risks to associated hardware operations.

Immediate Action: Update the sequencing-server component to the latest version provided by NASA-AMMOS. Review the vendor security advisory to verify if specific configuration changes are required in addition to the software update.

Proactive Monitoring: Review application access logs for requests to /command-expansion/put-expansion or /put-dictionary that lack valid Authorization headers or show anomalous session_variables.

Compensating Controls: Implement strict network-level access controls to ensure only known, authorized clients can reach the sequencing-server endpoints.

Public Exploit Available: No (exploit_available unknown).

Given the critical nature of the sequencing-server and the risk posed by arbitrary command expansion, immediate patching is required. Organizations should treat this as a high-priority remediation to ensure the integrity of sequencing operations.