Cybersecurity researchers disclose critical SAML and NASA software flaws

cybersecurity SAML vulnerabilities NASA spacecraft commands AI-assisted testing authentication bypass

Security researchers have identified critical vulnerabilities in two distinct software environments. Using Anthropic’s Claude AI, researchers at Oblique Security uncovered flaws in Security Assertion Markup Language (SAML) implementations. These vulnerabilities, which include SAML signature wrapping, could allow attackers to bypass authentication and take over user accounts in projects such as Authentik, PHP litesaml/lightsaml, OneUptime, and Java saml-client.

Separately, Cycode researchers disclosed a high-severity vulnerability chain in NASA/JPL’s AIT-GUI, a browser-based console for the open-source AMMOS Instrument Toolkit. The flaws, rated 9.4 on the CVSS scale, could allow unauthenticated attackers to issue arbitrary commands to spacecraft and instruments. The issue stems from a lack of authentication, authorization, and CSRF protection, as well as unvalidated input that allows for path traversal and server-side script execution.

Entities

Anthropic · Claude AI · Cycode · JPL · NASA

Sources

Claude AI Finds SAML Security Flaws That Can Let Attackers Take Over Accounts [cybersecuritynews.com]

23 days ago

Critical Authentication Bypass in NASA AIT-GUI [flagthis.com]

21 days ago

NASA AIT-GUI: Unauthentifizierte Angreifer könnten Befehle für Raumfahrzeuge ausführen [www.it-boltwise.de]

23 days ago

Critical NASA AIT-GUI Flaw Lets Unauthenticated Attackers Issue Spacecraft Commands [cybersecuritynews.com]

23 days ago

NASA's ground control software has a worrying security flaw which could let hackers contact spacecraft [www.techradar.com]

22 days ago

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands [thehackernews.com]

23 days ago