Summary by dewankpant
XXE Injection via Regex Bypass in NASA CMR AQL Endpoint
Severity: Critical (CVSS 9.1)
Status: Patched
Researcher: Dewank Pant (dewankpant)
Recognized by: NASA VDP Letter of Recognition, March 11, 2026
Overview
A critical XML External Entity (XXE) Injection vulnerability was
identified in NASA's Common Metadata Repository (CMR), affecting
the publicly accessible AQL search endpoint
(POST /search/concepts/search). The vulnerability stemmed from
an insufficient regex-based DOCTYPE sanitization that failed to
match multi-line DOCTYPE declarations, allowing complete bypass
of the input filter.
Impact
Successful exploitation enabled:
- Server-Side Request Forgery (SSRF) confirmed via outbound HTTP callbacks from NASA production infrastructure
- Out-of-band data exfiltration via external DTD parameter entities, with confirmed extraction of AWS Account ID, ECS cluster ARN, internal EC2 hostnames, kernel version, and container metadata from the production environment
- Blind file system enumeration via HTTP response code differential oracle
- Internal service enumeration via timing and response code differentials
- Denial of Service via 75-second timeout multiplication per entity reference
Root Cause
The sanitization function in common-lib/src/cmr/common/xml.clj
applied the regex #"<!DOCTYPE.*?>" which does not match newline
characters by default in Java regex. Multi-line DOCTYPE
declarations bypassed the filter entirely, reaching the
clojure.data.xml/parse-str parser which had external entity
processing enabled by default.
Resolution
Fixed in: https://github.com/nasa/Common-Metadata-Repository/pull/2378
Reported through NASA VDP via Bugcrowd. Vulnerability triaged,
confirmed, and resolved by the NASA security team.