CVE-2024-35058
📋 TL;DR
This vulnerability in NASA AIT-Core's API wait function allows attackers to execute arbitrary code by sending a specially crafted string. It affects NASA AIT-Core version 2.5.2 and potentially earlier versions. Attackers can exploit this to gain control of affected systems.
💻 Affected Systems
- NASA AIT-Core
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/administrator privileges, data exfiltration, and persistent backdoor installation.
Likely Case
Remote code execution leading to service disruption, data theft, and lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting the AIT-Core service.
🎯 Exploit Status
The vulnerability appears to be exploitable without authentication via crafted API requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.5.3 or later
Vendor Advisory: https://github.com/advisories/GHSA-4gxj-5mmr-7pxq
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Stop the AIT-Core service. 3. Upgrade to v2.5.3 or later. 4. Restart the service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to AIT-Core API endpoints to trusted IPs only
# Example using iptables for Linux
iptables -A INPUT -p tcp --dport [AIT-CORE-PORT] -s [TRUSTED-IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [AIT-CORE-PORT] -j DROP
API Endpoint Disablement
allTemporarily disable the vulnerable API wait function if not required
# Modify AIT-Core configuration to disable the wait API endpoint
🧯 If You Can't Patch
- Implement strict network segmentation to isolate AIT-Core systems from critical infrastructure
- Deploy web application firewall (WAF) rules to block suspicious API requests to the wait endpoint
🔍 How to Verify
Check if Vulnerable:
Check the AIT-Core version number in the application interface or configuration filesCheck Version:
# Check version in AIT-Core configuration or via API if availableVerify Fix Applied:
Verify the version is v2.5.3 or later and test the API wait function with safe inputs📡 Detection & Monitoring
Log Indicators:
- Unusual API requests to wait endpoint
- Multiple failed authentication attempts followed by API calls
- Suspicious process creation from AIT-Core service
Network Indicators:
- Unusual outbound connections from AIT-Core host
- Traffic patterns indicating data exfiltration
- Unexpected network scans originating from AIT-Core system
SIEM Query:
source="ait-core" AND (url="*/api/wait*" OR process="unusual_executable")