CVE-2024-35061
📋 TL;DR
NASA AIT-Core v2.5.2 uses unencrypted network channels, enabling man-in-the-middle attacks. When combined with CVE-2024-35059, this allows unauthenticated remote code execution. Organizations using AIT-Core v2.5.2 are affected.
💻 Affected Systems
- NASA AIT-Core
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via unauthenticated remote code execution leading to data theft, system destruction, or lateral movement.
Likely Case
Data interception and manipulation through man-in-the-middle attacks, potentially leading to credential theft or data corruption.
If Mitigated
Limited to network sniffing without RCE if CVE-2024-35059 is patched or other controls prevent exploitation.
🎯 Exploit Status
Exploitation requires chaining two CVEs and MITM positioning, but public advisories provide technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.5.3 or later
Vendor Advisory: https://github.com/advisories/GHSA-jqff-8g2v-642h
Restart Required: Yes
Instructions:
1. Update AIT-Core to v2.5.3 or later. 2. Restart all AIT-Core services. 3. Verify encryption is enabled in configuration.
🔧 Temporary Workarounds
Enable TLS/SSL Encryption
allConfigure AIT-Core to use encrypted channels instead of plaintext communication.
# Edit AIT-Core configuration to enable SSL/TLS
# Set appropriate encryption settings in config files
Network Segmentation
allIsolate AIT-Core systems to prevent MITM attacks from untrusted networks.
# Configure firewall rules to restrict AIT-Core traffic
# Use VLANs or network zones to isolate systems
🧯 If You Can't Patch
- Implement strict network controls to prevent MITM attacks (VPNs, encrypted tunnels, network segmentation)
- Monitor for unusual network traffic patterns and implement IDS/IPS rules for AIT-Core communication
🔍 How to Verify
Check if Vulnerable:
Check AIT-Core version: if v2.5.2 and using default configuration, system is vulnerable.Check Version:
# Check AIT-Core version in application logs or via package managerVerify Fix Applied:
Verify AIT-Core version is v2.5.3+ and check configuration for enabled encryption.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from AIT-Core
- Authentication failures or unexpected user activity
Network Indicators:
- Unencrypted AIT-Core network traffic on unusual ports
- MITM attack patterns in network logs
SIEM Query:
source="ait-core" AND (event_type="process_execution" OR protocol="plaintext")🔗 References
- https://github.com/advisories/GHSA-jqff-8g2v-642h
- https://github.com/advisories/GHSA-qv6x-53jj-vw59
- https://www.linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze
- https://github.com/advisories/GHSA-jqff-8g2v-642h
- https://github.com/advisories/GHSA-qv6x-53jj-vw59
- https://www.linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze
