Summary by azeemakhtar4e8764
NASA HEASARC TAP/ADQL SQL Injection via PostgreSQL Unicode Escape
Target: heasarc.gsfc.nasa.gov/xamin/vo/tap/sync
Severity: P3 | CVSS: Medium
Status: Patched & Verified (August 10, 2026)
Summary
The NASA HEASARC X-ray Astronomy Archive TAP (Table Access Protocol) endpoint was vulnerable to SQL injection via PostgreSQL Unicode escape sequences. By supplying ADQL queries containing U&'\0027' (Unicode representation of a single quote) and U&"\0070..." encoded identifiers, the ADQL-to-SQL translation layer passed unsanitized input directly to the PostgreSQL backend, bypassing standard quote-based input filters.
Impact
An unauthenticated attacker could enumerate full database metadata, schema structure, and table/column names from the HEASARC archive database without valid credentials.
Technique
The vulnerability exists at the ADQL query translation layer — where ADQL syntax is converted to SQL via string operations rather than parameterized binding — making it distinct from standard ORM-protected endpoints.
Resolution
NASA patched the ADQL query preprocessor to reject Unicode escape sequences. All U& vectors now return a syntax error at the preprocessor level. Schema catalog access is additionally blocked.