Summary by itz_madhusankha
Reflected Cross-Site Scripting (XSS) in NASA TrekWS
Researcher: Madhusankha Nayanajith
Affected service: NASA Trek Web Services (TrekWS)
Affected host: trek.nasa.gov
Vulnerability type: Reflected Cross-Site Scripting (XSS)
Severity: P3
Status: Resolved
Summary
During authorized security research under the NASA Vulnerability Disclosure Program, I identified a reflected Cross-Site Scripting (XSS) vulnerability in the TrekWS light configuration endpoint hosted on trek.nasa.gov.
The issue occurred when attacker-controlled input supplied through date parameters was reflected into an HTML error response without appropriate output encoding. Under the affected response conditions, a specially crafted request could cause JavaScript to execute in the context of the trek.nasa.gov origin when a victim opened the crafted URL in a browser.
Potential Impact
Depending on the victim's access and the application's security controls, successful exploitation could allow an attacker to perform actions within the affected web origin, access information available to the injected script, or present deceptive content through a trusted NASA subdomain.
Remediation
Recommended mitigations included context-appropriate output encoding, strict validation of date parameters, consistent use of a non-HTML content type for API error responses, and appropriate browser security headers.
Disclosure Status
The vulnerability was reported through Bugcrowd, reviewed by the platform, and subsequently marked as Resolved.
This summary documents the finding for responsible disclosure and defensive security awareness.