XML External Entity Injection in NASA CMR Ingest API - info dump

Disclosed by
thomasito
Summary by thomasito

An XXE vulnerability was identified in NASA’s Common Metadata Repository that enabled unauthenticated arbitrary file reads and server-side request forgery (SSRF).

Affected endpoints:

  • Production: https://cmr.earthdata.nasa.gov/ingest/providers/*/validate/collection/*
  • UAT: https://cmr.uat.earthdata.nasa.gov/ingest/providers/*/validate/collection/*

Initial testing demonstrated blind SSRF. Subsequently, error-based XXE techniques revealed entity expansion in parser error responses, resulting in a arbitrary file read vulnerability.

Activity