PT-2024-26305 · Nasa · Nasa Ait-Core

Andy Olchawa + 1 · Published 2024-05-21 · Updated 2024-07-17 · CVE-2024-35061

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NASA AIT-Core version 2.5.2

Description The issue allows attackers to execute a man-in-the-middle attack due to the use of unencrypted channels for data exchange over the network. This can lead to unauthenticated, fully remote code execution when combined with other vulnerabilities.

Recommendations For NASA AIT-Core version 2.5.2, consider implementing encrypted communication channels to prevent man-in-the-middle attacks. As a temporary workaround, restrict network access to trusted sources until a patch is available.

Exploit

Fix

Missing Encryption of Sensitive Data

Special Elements Injection

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-311

CWE-74

CWE-319

Related Identifiers

CVE-2024-35061

GHSA-JQFF-8G2V-642H

GHSA-QV6X-53JJ-VW59

Affected Products

Nasa Ait-Core

References · 14

• 🔥 https://linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze · Exploit
• https://osv.dev/vulnerability/GHSA-qv6x-53jj-vw59 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35061 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35059 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35061 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqff-8g2v-642h · Vendor Advisory
• https://github.com/NASA-AMMOS/AIT-Core · Note
• https://t.me/cvenotify/80749 · Telegram Post
• https://t.me/cvenotify/80685 · Telegram Post
• https://twitter.com/CVEnew/status/1793284050503041348 · Twitter Post
• https://github.com/advisories/GHSA-jqff-8g2v-642h · Note
• https://t.me/cvenotify/86538 · Telegram Post
• https://t.me/cvenotify/80615 · Telegram Post
• https://github.com/advisories/GHSA-qv6x-53jj-vw59 · Note