Is CVE-2023-45884 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-45884 being exploited in the wild.

How severe is CVE-2023-45884?

Low severity, with a CVSS score of 3.1, published 9 November 2023.

Which products and versions are affected?

Nasa Open MCT through 3.1.0; openmct (npm) SEMVER:introduced=0,fixed=3.1.1.

Is there a fix for CVE-2023-45884?

Yes. openmct (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-45884 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2023-45884?

Check whether you run Nasa Open MCT or openmct (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-45884: NASA Open MCT cross-site request forgery in flexibleLayout plugin

CVE-2023-45884 · Severity: low · CVSS 3.1 · Published 2023-11-09

NASA Open MCT is a web-based mission control framework used to monitor and manage space operations. A cross-site request forgery vulnerability in the flexibleLayout plugin could allow attackers to craft malicious requests that trick authenticated users into performing unintended actions, such as viewing or exfiltrating sensitive mission data. The vulnerability is especially dangerous when combined with existing XSS flaws and the absence of Content Security Policy protections.

Technologies: Nasa Open MCT, openmct (npm). Vendors: Nasa, npm.

Quick answers

Is CVE-2023-45884 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-45884 being exploited in the wild.
How severe is CVE-2023-45884?: Low severity, with a CVSS score of 3.1, published 9 November 2023.
Which products and versions are affected?: Nasa Open MCT through 3.1.0; openmct (npm) SEMVER:introduced=0,fixed=3.1.1.
Is there a fix for CVE-2023-45884?: Yes. openmct (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-45884 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2023-45884?: Check whether you run Nasa Open MCT or openmct (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openmct (npm): upgrade to 3.1.1 or later
```
npm install openmct@3.1.1
```

Technical details

This CSRF vulnerability (CWE-352) exists in NASA Open MCT versions up to 3.1.0 within the flexibleLayout plugin component. The root cause is the absence of CSRF protections (such as anti-CSRF tokens or SameSite cookie attributes) in the application. The attack is primarily network-based and requires user interaction—an authenticated user must be tricked into visiting a malicious webpage or performing an action while logged into Open MCT. When chained with the existing stored XSS flaw in the flexibleLayout component (triggered during drag-and-drop operations in edit mode), an attacker can inject malicious JavaScript that performs arbitrary API calls to the backend database on behalf of the victim, exfiltrating mission-critical data. The vulnerability was fixed in version 3.1.1, which added the eslint-plugin-no-unsanitized plugin and properly sanitized user-controlled input in the affected components.

Affected products

NASA Open MCT through 3.1.0

Identifiers

CVE-2023-45884
GHSA-4g88-4hgm-m99x

Timeline

2023-11-09: disclosed: CVE-2023-45884 published
2023-10-23: patched: Fix merged in release/3.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.