Summary by obaskly
An unauthenticated arbitrary file write vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) was discovered in the NASA CMR Search API's shapefile upload functionality. The endpoints /search/collections and /search/granules accept shapefile uploads as ZIP files. However, the ZIP extraction function (shapefile.clj) failed to validate entry names against directory traversal sequences (../).
This flaw, commonly known as "Zip Slip," allowed an unauthenticated attacker to write arbitrary files to unintended locations outside of the designated extraction directory. Because the underlying service was executing with root privileges, this arbitrary file write vulnerability could be chained or leveraged to achieve full system compromise. The issue was verified by writing a benign file to the disk and confirming its existence.