The NASA Online Directives Information System suffers from a cross site scripting vulnerability that can be leveraged via the User-Agent header. The researcher has notified NASA and has not received a response.
09668c9e1fd08a529b49b8e41a40a423Cross-site Scripting (XSS) Vulnerability in NASA through User Agent - Binit Ghimire
As of October 19, 2019, there exists a Reflected Cross-site Scripting (XSS) vulnerability in a sub-domain of the official NASA website as a result of the User Agent HTTP request header getting displayed in the webpage. The vulnerability was discovered on October 11, 2019 and a video was uploaded to YouTube regarding the reproduction of the vulnerability.
Vulnerable URLs:
1. https://nodis3.gsfc.nasa.gov/search_ft.cfm
2. https://nodis3.gsfc.nasa.gov/suggestions_action.cfm
Proof-of-Concept (PoC) Video: https://youtu.be/O-KtSUUqnzM
How to Reproduce?
Step 1: Visit https://nodis3.gsfc.nasa.gov/search_ft.cfm
Here, you will be able to see that it displays your User-Agent in the form of "Your browser is {User-Agent}". In my case, it displays "Your browser is Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0".
Step 2: Then, open your browser's Developer Tools, and add a custom User Agent string containing the following XSS payload:
<svg/onload=alert(document.domain)>
You can also modify the value of User Agent by intercepting the GET request sent to the server while visiting https://nodis3.gsfc.nasa.gov/search_ft.cfm and then forwarding the request.
I have explained about this in the Proof-of-Concept (PoC) video along with this vulnerability report.
Step 3: Now, visit the webpage with the modified User Agent value, and you will be able to see the XSS payload in the User Agent getting executed.
Author Details:
Name: Binit Ghimire
Profile: https://packetstormsecurity.com/user/binit/
Webpage: https://binitghimire.com.np
Twitter: @WHOISbinit (https://twitter.com/WHOISbinit)
Facebook Page: https://www.facebook.com/TheBinitGhimure
Facebook Profile: https://www.facebook.com/InternetHeroBINIT
GitHub: https://github.com/TheBinitGhimure
LinkedIn: https://www.linkedin.com/in/thebinitghimire/