A critical, unauthenticated Server-Side Request Forgery (SSRF) vulnerability in NASA earthdata-search allows remote attackers to scan and map internal network infrastructure.

The application fails to validate the imageSrc parameter in the scaleImage function, allowing unauthenticated remote attackers to force the server to initiate arbitrary GET requests. This flaw effectively turns the server into an internal network proxy, enabling attackers to bypass network boundaries and perform internal host discovery based on response latency.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality and integrity of NASA's internal network environment. By leveraging the application as a proxy, an attacker can map internal, otherwise inaccessible, services and potentially identify high-value targets for further exploitation. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized network reconnaissance and potential lateral movement within the cloud infrastructure.

Immediate Action: Update the earthdata-search application to a version where the scaleImage handler implements strict allowlisting of permitted domains and rejects requests to internal or private IP address ranges.

Proactive Monitoring: Review web server and API Gateway logs for anomalous requests to the /scale endpoint, specifically monitoring for patterns involving internal IP addresses or unusual timing in response latency.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to block requests containing suspicious URL schemes or attempts to access internal network segments (e.g., 127.0.0.0/8, 169.254.0.0/16, or RFC1918 addresses).

Public Exploit Available: Yes — a technical proof-of-concept and detailed research write-up are available via the Thoropass vulnerability research program repository.

Given the availability of a public proof-of-concept and the potential for internal network mapping, this vulnerability must be addressed with high priority. Administrators should audit their deployment of NASA earthdata-search immediately and apply the necessary patches to restrict the SSRF vector, as this flaw provides a significant foothold for attackers attempting to gain visibility into restricted internal segments.