CVE-2026-47731: 
Python 脆弱性の分析と軽減

CVE-2026-47731 is a path traversal vulnerability (CWE-22) in the Binary Stream Capture (BSC) component of NASA AMMOS Instrument Toolkit (AIT-Core) that allows unauthenticated remote attackers to append attacker-controlled data to arbitrary files on the host filesystem. The vulnerability affects ait-core (pip) versions up to and including 3.1.0 and 2.x versions before 2.6.1. It was published by researcher ehtec on May 19, 2026, and added to the GitHub Advisory Database on June 5, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, AIT-Core Advisory).

The root cause is that StreamCaptureManagerServer in ait/core/bsc.py exposes an unauthenticated HTTP POST endpoint (/<NAME>/start) that passes all form fields — including path, file_name_pattern, and log_dir_path — directly into the handler configuration without any validation (CWE-22). In SocketStreamCapturer._get_log_file, the log path is constructed using os.path.join(log_dir, handler['path'], filename); on POSIX systems, supplying an absolute path value causes os.path.join to discard the configured log_dir base entirely, enabling full directory escape. The resulting path is then opened in append-binary mode (ab) via pcap.open, and if the target directory does not exist, os.makedirs creates it — all without any realpath-based confinement or symlink protection. A secondary attack vector allows exploitation via a browser-based CSRF-style attack: a malicious webpage can use JavaScript fetch() with mode: 'no-cors' to send the exploit POST request to a locally running ait-bsc instance, even if the service is only bound to localhost (GitHub Advisory, AIT-Core Advisory).

A remote unauthenticated attacker can append arbitrary binary data (wrapped in a PCAP packet header) to any file writable by the ait-bsc process, including Python source files, shell scripts, and configuration files. This can corrupt critical AIT-Core components (e.g., dmc.py), causing the server to crash on restart when Python attempts to execute the corrupted code. If the attacker can cause the modified scripts to be executed (e.g., by triggering a service restart), the vulnerability can escalate to Remote Code Execution. A bug in the TCP handler may also cause data to be written in an infinite loop after connection close, leading to disk exhaustion and denial of service (GitHub Advisory).

1. Reconnaissance: Identify hosts running ait-bsc (default port 8080) using network scanning tools such as Nmap or Shodan, or identify users on the same network who might visit an attacker-controlled webpage.
2. Direct network attack — create a malicious handler: Send an unauthenticated HTTP POST to http://<target>:8080/<HANDLER_NAME>/start with form fields loc=, port=9999, conn_type=udp, path=/path/to/target/dir/, and file_name_pattern=target_file.py. This instructs ait-bsc to bind a UDP socket and log captured data to the specified arbitrary path.
3. Send attacker-controlled payload: Transmit a UDP datagram containing the malicious payload (e.g., Python code) to the bound UDP port (e.g., 127.0.0.1:9999). ait-bsc wraps it in a PCAP header and appends it to the target file.
4. Browser-based (CSRF) attack: Host a malicious HTML page containing a JavaScript fetch() call (with mode: 'no-cors') that POSTs the handler creation request to http://127.0.0.1:8080/<HANDLER_NAME>/start. When a victim on the local network visits the page, their browser sends the exploit request. The attacker's TCP server then delivers the payload when ait-bsc connects back.
5. Achieve code execution: Wait for the corrupted file (e.g., a Python module) to be executed — for example, by triggering a service restart — causing the injected code to run under the ait-bsc process privileges.
6. Cleanup: Send an HTTP DELETE to http://<target>:8080/<HANDLER_NAME>/stop to remove the handler and reduce forensic traces (GitHub Advisory, AIT-Core Advisory).

• Network: Unexpected HTTP POST requests to http://<host>:8080/<any_name>/start with form fields containing absolute paths (e.g., path=/home/... or path=/etc/...) or .. sequences; outbound TCP connections from the ait-bsc process to unknown external IP addresses on non-standard ports.
• File System: Newly created or modified files outside the configured root_log_directory (e.g., /tmp) with PCAP magic bytes (d4 c3 b2 a1) prepended to unexpected file types such as .py or .sh scripts; unexpected directories created by the ait-bsc process outside its log root.
• Logs: ait-bsc HTTP access logs showing POST requests to /<name>/start endpoints with suspicious path or log_dir_path form parameters; Python import errors or syntax errors in AIT-Core logs after a restart, indicating file corruption.
• Process: Unusual child processes spawned by the ait-bsc Python process (e.g., /bin/bash, curl, wget) following a service restart; abnormal disk usage growth caused by the TCP handler infinite-write bug (GitHub Advisory).

Upgrade ait-core to version 3.1.1 (for 3.x users) or version 2.6.1 (for 2.x users), which constrain BSC log writes to the configured root_log_directory and reject any REST-supplied paths that attempt to traverse outside it (AIT-Core v3.1.1, AIT-Core v2.6.1). If immediate upgrade is not possible, restrict network access to the ait-bsc HTTP API port (default 8080) using firewall rules so it is only reachable from trusted hosts. Additionally, configure ait-bsc to bind only to a loopback or protected interface, avoid using world-writable directories like /tmp as the root_log_directory, and consider adding HTTP authentication to the BSC REST API (GitHub Advisory).

The vulnerability was reported by security researcher ehtec and published by NASA-AMMOS maintainer EmilyPascua on May 19, 2026, with patches released the same day. The advisory was added to the GitHub Advisory Database on June 5, 2026, and detected by Qualys scanners shortly after. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).