Hyrax Docker
Monthly
Unvalidated HTTP redirect handling in OPeNDAP Hyrax Docker 1.18.0 enables SSRF-assisted credential exfiltration, leaking Earthdata authentication headers (User-Id, Echo-Token) to attacker-controlled endpoints. The AllowedHosts allowlist - intended to restrict outbound server-side requests - is silently bypassed when Hyrax follows HTTP redirects without re-validating the destination against the allowlist, causing sensitive Earthdata Login (EDL) session headers to be forwarded externally. No active exploitation has been confirmed (EPSS 0.21%, 11th percentile; not in CISA KEV), but the confidentiality impact is rated High due to the direct exposure of bearer-equivalent credentials used to access NASA/Earthdata scientific datasets.
Unvalidated HTTP redirect handling in OPeNDAP Hyrax Docker 1.18.0 enables SSRF-assisted credential exfiltration, leaking Earthdata authentication headers (User-Id, Echo-Token) to attacker-controlled endpoints. The AllowedHosts allowlist - intended to restrict outbound server-side requests - is silently bypassed when Hyrax follows HTTP redirects without re-validating the destination against the allowlist, causing sensitive Earthdata Login (EDL) session headers to be forwarded externally. No active exploitation has been confirmed (EPSS 0.21%, 11th percentile; not in CISA KEV), but the confidentiality impact is rated High due to the direct exposure of bearer-equivalent credentials used to access NASA/Earthdata scientific datasets.