CyberRota Analysis
AI-GeneratedThe Aerie/PlanDev sequencing server is vulnerable due to improper validation of session roles, allowing unauthenticated attackers to exploit the system by manipulating session variables in JSON requests. This critical flaw enables them to insert arbitrary expansion rules and write command dictionaries, potentially compromising spacecraft command operations. Organizations utilizing this sequencing server should prioritize immediate remediation to mitigate the risk of unauthorized access and control over critical aerospace functions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.