CVE-2023-45282: NASA Open MCT prototype pollution in import action

CVE-2023-45282 · Severity: low · CVSS 3.1 · Published 2023-10-06

NASA Open MCT is a web-based mission control framework used for visualizing and managing spacecraft operations and telemetry data. A prototype pollution vulnerability in the import feature allows an attacker to inject malicious properties into the application's JavaScript object prototypes via a crafted import file. This could enable an attacker to escalate privileges, modify application behavior, or potentially execute arbitrary code, compromising the integrity of critical mission data systems.

Technologies: Nasa Open MCT, openmct (npm). Vendors: Nasa, npm.

Quick answers

Is CVE-2023-45282 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-45282 being exploited in the wild.
How severe is CVE-2023-45282?
Low severity, with a CVSS score of 3.1, published 6 October 2023.
Which products and versions are affected?
Nasa Open MCT before 3.1.0 (all versions up to 3.0.2); openmct (npm) SEMVER:introduced=0,last_affected=3.0.2.
Is there a fix for CVE-2023-45282?
A patch was published on 2023-10-02: Fix merged in PR #7094 with commit 545a177 and included in v3.1.0 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-45282 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2023-45282?
Check whether you run Nasa Open MCT or openmct (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a prototype pollution (CWE-1321) flaw in NASA Open MCT's import action handler that fails to properly sanitize untrusted JSON data before processing it. When a user imports a JSON file, the application performs an insecure recursive merge operation that does not filter the __proto__ property. An unauthenticated attacker can craft a malicious JSON import file containing a __proto__ property that, when merged into JavaScript objects, pollutes the global prototype chain. This allows modification of behavior for any code inheriting from affected prototypes. The fix, introduced in commit 545a177, adds a filter__proto__ sanitization function to prevent __proto__ entries from being processed during import and localStorage operations. The vulnerability affects all versions up to and including 3.0.2; versions 3.1.0 and later include the patch.

Affected products

  • NASA Open MCT before 3.1.0 (all versions up to 3.0.2)

Identifiers

  • CVE-2023-45282
  • GHSA-4xcx-cwrq-w792

Timeline

  • 2023-10-06: disclosed: Vulnerability published via GHSA and NVD
  • 2023-10-02: patched: Fix merged in PR #7094 with commit 545a177 and included in v3.1.0 release
  • 2023-10-09: other: GitHub security advisory reviewed and confirmed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.