Junglewise Threat Intelligence

CVE-2023-45282: NASA Open MCT prototype pollution in import action

CVE-2023-45282 · Severity: low · CVSS 3.1 · Published 2023-10-06

Technologies: Nasa Open MCT, openmct (npm). Vendors: Nasa, npm.

Executive brief

NASA Open MCT is a web-based mission control framework used for visualizing and managing spacecraft operations and telemetry data. A prototype pollution vulnerability in the import feature allows an attacker to inject malicious properties into the application's JavaScript object prototypes via a crafted import file. This could enable an attacker to escalate privileges, modify application behavior, or potentially execute arbitrary code, compromising the integrity of critical mission data systems.

Technical details

The vulnerability is a prototype pollution (CWE-1321) flaw in NASA Open MCT's import action handler that fails to properly sanitize untrusted JSON data before processing it. When a user imports a JSON file, the application performs an insecure recursive merge operation that does not filter the __proto__ property. An unauthenticated attacker can craft a malicious JSON import file containing a __proto__ property that, when merged into JavaScript objects, pollutes the global prototype chain. This allows modification of behavior for any code inheriting from affected prototypes. The fix, introduced in commit 545a177, adds a filter__proto__ sanitization function to prevent __proto__ entries from being processed during import and localStorage operations. The vulnerability affects all versions up to and including 3.0.2; versions 3.1.0 and later include the patch.

Affected products

  • NASA Open MCT before 3.1.0 (all versions up to 3.0.2)

Timeline

  • 2023-10-06: disclosed: Vulnerability published via GHSA and NVD
  • 2023-10-02: patched: Fix merged in PR #7094 with commit 545a177 and included in v3.1.0 release
  • 2023-10-09: other: GitHub security advisory reviewed and confirmed

References

Related threats