NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating packet capture “handlers.” Because the code blindly trusts path‑related form fields, a remote client can: Bypass the configured log root and direct BSC to log to arbitrary filesystem paths (path traversal / directory escape), and Append attacker‑controlled data to those files, using the privileges of theait-bsc process. There are two ways for a remote attacker to …