Description

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation. The Source/OBPGSession.py handler parses server response headers without sanitization and passes attacker-controlled field values to subprocess calls, enabling arbitrary command execution when a user performs a data download operation against a tampered server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T11:17:30.780Z",
  "pubdate": "2026-08-10T11:17:30.780Z",
  "executiveSummary": "An OS command injection vulnerability exists in the NASA HyperCP (main branch) software, specifically within the data download mechanism.\nThe vulnerability allows a network-adjacent attacker capable of intercepting or spoofing network traffic from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the targeted researcher's workstation.\nThe root cause stems from insecure handling of server response headers in the application logic, which passes unsanitized data directly into underlying operating system subprocess calls.\nSuccessful exploitation requires the victim to initiate a data download operation while exposed to a malicious or spoofed server capable of manipulating HTTP response headers.\nThe impact of this vulnerability is critical, granting the attacker the ability to achieve arbitrary code execution under the security context of the user running the HyperCP application.\nThis introduces severe risk implications, including potential workstation compromise, data exfiltration, and lateral movement within the victim's local network environment.",
  "technicalDetails": "The vulnerability resides within the Source/OBPGSession.py handler component of NASA HyperCP (main branch).\nThe root cause is an improper neutralization of special elements used in an OS command, commonly categorized as OS Command Injection.\nDuring a data download operation, the vulnerable component parses server response headers received from the remote endpoint (oceandata.sci.gsfc.nasa.gov) without applying proper input sanitization, validation, or encoding.\nThe parsed field values, which are entirely controlled by the remote server or an adversary performing a Man-in-the-Middle (MitM) or DNS spoofing attack, are subsequently passed directly into operating system subprocess execution calls.\nThe attack flow proceeds as follows: 1) An attacker positions themselves adjacent to the network path between the client running NASA HyperCP and the legitimate server, or successfully spoofs the designated endpoint. 2) The victim initiates a standard data download operation via the application. 3) The malicious or spoofed server responds with specially crafted HTTP response headers containing embedded OS commands within the vulnerable header fields. 4) The Source/OBPGSession.py script parses the headers and appends the attacker-controlled strings into a subprocess invocation without validation. 5) The operating system executes the resulting command string, granting the attacker arbitrary command execution on the researcher's workstation.\nAuthentication requirements: No authentication against the HyperCP application is required by the attacker, as the vulnerability is triggered via external server responses.\nPrivilege requirements: Exploitation executes commands with the privileges of the local user running the NASA HyperCP application.\nNetwork exposure: The vulnerability is exploitable by a network-adjacent attacker who can intercept, spoof, or manipulate network traffic directed to oceandata.sci.gsfc.nasa.gov.\nPost-exploitation impact includes full compromise of the local workstation environment, unauthorized access to sensitive research data, and potential execution of malicious payloads."
}