Description

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T16:19:19.327Z",
  "pubdate": "2026-08-31T16:19:19.327Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the NASA earthdata-search 1.0.0 component, specifically within the granules endpoint.\nThe vulnerability originates from the improper sanitization of user-supplied input provided to the 'openSearchOsdd' argument within the 'OpenSearchGranuleSearchLambda' function.\nThis flaw allows a remote, unauthenticated attacker to induce the server to make unauthorized requests to arbitrary internal or external resources.\nThe risk implication is significant, as successful exploitation may allow an attacker to probe internal network infrastructure, bypass firewalls, or interact with metadata services often found in cloud environments.\nGiven that the exploit is publicly available and the vendor has not addressed the disclosure, the risk of active exploitation is elevated.\nThe attack is remotely executable, requiring no prior authentication or specific privilege level, making it a critical entry point for further unauthorized actions.",
  "technicalDetails": "The vulnerability resides in the 'serverless/src/openSearchGranuleSearch/handler.js' file of the 'granules' endpoint component. The root cause is the insufficient validation and sanitization of the 'openSearchOsdd' parameter processed by the 'OpenSearchGranuleSearchLambda' function.\nIn a typical request flow, the lambda function consumes the 'openSearchOsdd' argument to facilitate OpenSearch descriptor document retrieval or parsing. Because the application logic fails to implement a strict allow-list of permitted domains or URI schemes, the backend function is susceptible to URI manipulation.\nAn attacker can exploit this by supplying a crafted URL as the value for 'openSearchOsdd'. When the application processes this input, the 'OpenSearchGranuleSearchLambda' executes an outbound HTTP request to the malicious or unintended destination. By targeting internal IP addresses (e.g., 169.254.169.254 for cloud instance metadata) or restricted services, an attacker can exfiltrate sensitive environment credentials, configuration details, or reach backend systems not exposed to the public internet.\nThe attack vector is remotely accessible over standard network protocols, and the absence of authentication requirements means that any actor capable of reaching the granules endpoint can initiate the request. The payload behavior involves the server performing a GET request on behalf of the attacker, effectively masking the true source of the request behind the server's identity.\nPost-exploitation, the impact is severe. Beyond simple network reconnaissance, successful SSRF can be leveraged for Cross-Site Scripting (XSS) if the response is reflected, or as a pivot point to perform further attacks against the underlying serverless infrastructure. In cloud-hosted environments, such as AWS Lambda, this could result in the compromise of IAM roles associated with the function if the attacker retrieves metadata credentials.\nBecause the function is implemented in a serverless context, it relies on the integrity of the input validation logic within the handler. The current implementation fails to enforce a protocol check (e.g., restricting requests to HTTPS only) or a domain-specific allow-list, allowing the function to be coerced into acting as an open proxy for the attacker."
}