Internal Solr Query Injection enabling Local FIle Inclusion and Potential SSRF on trek.nasa.gov

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 23 Mar 2026 5 months ago
Priority P1 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by YeJunWon

The server forwards a q query to an internal network based on Apache Solr using a uuid query parameter.

An attacker can inject a new query into the internal network by using %26.

By controlling the Solr shards parameter via query injection, an attacker can gain access to internal resources through the internal Solr instance.

Activity