Reflected XSS Exploit Chain with Session Cookie Theft on NASA Subdomain

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 4 Nov 2025 7 months ago
Priority P5 Bugcrowd's VRT priority rating
Status Informational This vulnerability is seen as an accepted business risk

Summary by MandipGuragai

A reflected XSS vulnerability was discovered on a NASA subdomain via unsanitized User-Agent input. The initial report was marked as Informational, but this submission demonstrates a full exploit chain using a proxy-based payload to trigger JavaScript execution on a trusted NASA URL. This can lead to session hijacking and phishing attacks. The issue was responsibly reported via Bugcrowd.

Reflected XSS Exploit Chain with Session Cookie Theft on NASA Subdomain

Summary by MandipGuragai

Activity