XML External Entity (XXE) Injection via Regex Bypass in CMR AQL Parsing Enables SSRF, Service Enumeration, and Blind File Reads

Disclosed by
dewankpant
Summary by dewankpant

XXE Injection via Regex Bypass in NASA CMR AQL Endpoint

Severity: Critical (CVSS 9.1)

Status: Patched

Researcher: Dewank Pant (dewankpant)

Recognized by: NASA VDP Letter of Recognition, March 11, 2026

Overview

A critical XML External Entity (XXE) Injection vulnerability was
identified in NASA's Common Metadata Repository (CMR), affecting
the publicly accessible AQL search endpoint
(POST /search/concepts/search). The vulnerability stemmed from
an insufficient regex-based DOCTYPE sanitization that failed to
match multi-line DOCTYPE declarations, allowing complete bypass
of the input filter.

Impact

Successful exploitation enabled:

  • Server-Side Request Forgery (SSRF) confirmed via outbound HTTP callbacks from NASA production infrastructure
  • Out-of-band data exfiltration via external DTD parameter entities, with confirmed extraction of AWS Account ID, ECS cluster ARN, internal EC2 hostnames, kernel version, and container metadata from the production environment
  • Blind file system enumeration via HTTP response code differential oracle
  • Internal service enumeration via timing and response code differentials
  • Denial of Service via 75-second timeout multiplication per entity reference

Root Cause

The sanitization function in common-lib/src/cmr/common/xml.clj
applied the regex #"<!DOCTYPE.*?>" which does not match newline
characters by default in Java regex. Multi-line DOCTYPE
declarations bypassed the filter entirely, reaching the
clojure.data.xml/parse-str parser which had external entity
processing enabled by default.

Resolution

Fixed in: https://github.com/nasa/Common-Metadata-Repository/pull/2378

Reported through NASA VDP via Bugcrowd. Vulnerability triaged,
confirmed, and resolved by the NASA security team.

Activity