CVE-2023-45282
📋 TL;DR
CVE-2023-45282 is a prototype pollution vulnerability in NASA Open MCT (openmct) that allows attackers to modify JavaScript object prototypes through malicious import actions. This can lead to remote code execution, denial of service, or privilege escalation. All users running Open MCT versions before 3.1.0 are affected.
💻 Affected Systems
- NASA Open MCT (openmct)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or lateral movement within the network.
Likely Case
Denial of service, application instability, or limited privilege escalation within the Open MCT application context.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, potentially causing only application errors.
🎯 Exploit Status
Exploitation requires access to the import feature, which may require authentication depending on deployment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.0 and later
Vendor Advisory: https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0
Restart Required: Yes
Instructions:
1. Update Open MCT to version 3.1.0 or later using npm update openmct. 2. Restart the Open MCT application server. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable Import Functionality
allTemporarily disable the import feature in Open MCT configuration to prevent exploitation.
Modify Open MCT configuration to remove or disable import endpoints
Input Validation Proxy
allImplement a reverse proxy or WAF to validate and sanitize import requests before they reach Open MCT.
Configure WAF rules to block suspicious import payloads
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Open MCT instances from critical systems.
- Deploy runtime application self-protection (RASP) or similar tools to detect and block prototype pollution attempts.
🔍 How to Verify
Check if Vulnerable:
Check if Open MCT version is below 3.1.0 by examining package.json or running npm list openmct.Check Version:
npm list openmct | grep openmctVerify Fix Applied:
Confirm version is 3.1.0 or higher and test import functionality with known safe payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual import requests with malformed JSON/objects
- Application errors related to prototype modification
- Unexpected property assignments in object logs
Network Indicators:
- HTTP POST requests to import endpoints with suspicious payloads
- Unusual traffic patterns to Open MCT import functionality
SIEM Query:
source="openmct" AND (http_method="POST" AND uri_path="/import" AND (payload_contains="__proto__" OR payload_contains="constructor"))🔗 References
- https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0
- https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52
- https://nasa.github.io/openmct/
- https://www.linkedin.com/pulse/prototype-pollution-nasas-open-mct-cve-2023-45282
- https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0
- https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52
- https://nasa.github.io/openmct/
- https://www.linkedin.com/pulse/prototype-pollution-nasas-open-mct-cve-2023-45282
