Description

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T15:18:19.680Z",
  "pubdate": "2026-08-31T15:18:19.680Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the NASA earthdata-search 1.0.0 component, specifically within the scale Endpoint.\nThe vulnerability originates from the improper handling of user-supplied input during image processing, allowing a remote attacker to induce the server to make unauthorized requests to arbitrary network locations.\nThe impact of this flaw is significant, as it enables attackers to perform reconnaissance on internal network segments, interact with internal APIs, or access cloud metadata services that are not intended to be exposed to the public.\nThe attack can be executed remotely without prior authentication, posing a severe risk to the confidentiality and integrity of the internal infrastructure.\nThe vulnerability is currently public and active exploitation is possible, requiring immediate attention to mitigate exposure.",
  "technicalDetails": "The vulnerability is located within the scaleImage function, situated in the file serverless/src/scaleImage/handler.js of the scale Endpoint component.\nThe root cause of the SSRF vulnerability is the lack of strict validation and sanitization of user-provided input used to fetch or process remote images.\nWhen a request is made to the scale Endpoint, the application logic fails to verify if the target resource URL points to an authorized, trusted location.\nAn attacker can manipulate the input parameters passed to the scaleImage function, forcing the serverless function to perform a GET request to a specified URL. Because the function executes within the server-side environment, it utilizes the execution context's network privileges.\nExploitation flow: 1) The attacker identifies the exposed scale Endpoint within the earthdata-search architecture. 2) The attacker crafts a malicious request containing a crafted URL parameter aimed at internal assets, such as a metadata service (e.g., 169.254.169.254) or an internal backend service. 3) The serverless function, lacking egress filtering, initiates the outbound request to the specified target. 4) The server captures the response from the internal asset and potentially returns it to the attacker, or uses the interaction to perform unauthorized actions (e.g., modifying internal data or exfiltrating environment credentials).\nThe vulnerability is present in version 1.0.0. The lack of an allow-list or domain-based validation allows for arbitrary server-side requests to be initiated by remote, unauthenticated users. This bypasses typical perimeter security measures, as the malicious requests originate from trusted internal infrastructure."
}