Summary by marcelojr
Summary
An authentication bypass vulnerability was identified in the administrative API of the NASA MODAPS OKAPI repository management service. The application interface handles critical infrastructure deployment and metadata configurations, which were intended to be restricted by an edge protection layer (AWS Application Load Balancer).
However, due to a path normalization differential between the proxy/WAF layer and the backend ASGI application server, the restriction could be reliably bypassed. By submitting requests containing duplicate slashes (//-/admin/*) or encoded sequences (/%2f-/admin/*), an unauthenticated remote attacker could circumvent the edge rules.
Testing confirmed that the bypassed routes reached the underlying application logic and successfully triggered server-side validation handlers on mutating HTTP methods (such as PUT). The issue has been completely remediated by the NASA security team through proper server-side authorization checks and edge-rule adjustments.