Summary by n0RollBack
Unauthenticated Server-Side Request Forgery (SSRF) in the NASA Trek addManifest web service.
Summary
An unauthenticated endpoint in the Trek outreach web service accepted a user-controlled URL parameter and made the server issue an HTTP request to that URL and parse the response. No authentication, allowlist, or network egress restriction was enforced, so an external, unauthenticated requester could make the Trek server reach services on its own loopback interface and on the internal network segment behind it.
Endpoint
GET /moon/TrekServices/ws/outreach/eq/addManifest with an attacker-controlled manifestURL parameter. The request required no authentication.
Impact confirmed during testing
- The server was made to reach an internal search service bound to its loopback interface, an administrative interface that should only be reachable from the host itself.
- The server was made to reach an internal-only backend host that is not routable from the public Internet.
Together these confirmed that the Trek server could be used as a proxy to interact with internal, non-public services, which is the core risk of an internal-facing SSRF.
Severity
P2 (High). CVSS 3.1 base score 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Remediation
NASA remediated the endpoint so that it no longer performs the unrestricted server-side fetch. The submission was validated, accepted, and marked as resolved.
Testing statement
Reported under the NASA Vulnerability Disclosure Program. No data was exfiltrated. Testing was strictly limited to proving reachability of internal services, using a single source address.