CVE-2023-45884: NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability
Summary
CVE-2023-45884: NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability. Affects openmct versions < 3.1.1. Fixed in 3.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NASA Open MCT (aka openmct) is an open-source software package that provides a web-based mission control framework for visualization and analysis of spacecraft telemetry data. It offers a flexible and customizable layout for displaying various data sources and allows users to interact with the data in real-time. However, Open MCT is vulnerable to a Cross Site Request Forgery (CSRF) attack through the flexibleLayout plugin.
Vulnerability Detail
The Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT allows attackers to view sensitive information. By tricking a logged-in user into visiting a malicious website or clicking on a specially crafted link, an attacker can perform actions on behalf of the user without their consent or knowledge. In this case, the vulnerability is present in the flexibleLayout plugin, which is responsible for managing the layout of data sources within Open MCT. Exploiting this vulnerability can lead to unauthorized access to sensitive information.
How To Fix
Latest published version: 4.3.1 as of 22 Oct 2026
npm install openmct@4.3.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
npm install openmct@3.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by ensuring they do not visit untrusted websites or click on suspicious links while logged into Open MCT. Additionally, enabling CSRF protection mechanisms in web browsers can provide an extra layer of defense against CSRF attacks.
Conclusion
The Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT through version 3.1.0 allows attackers to view sensitive information by exploiting the flexibleLayout plugin. To mitigate the risk, users should upgrade to the latest version of Open MCT (3.1.1) and follow best practices for web security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openmct →
FAQ
NASA Open MCT is an open-source software package that provides a web-based mission control framework for visualization and analysis of spacecraft telemetry data.
A Cross Site Request Forgery (CSRF) vulnerability allows an attacker to perform actions on behalf of a logged-in user without their consent or knowledge. By tricking the user into visiting a malicious website or clicking on a specially crafted link, the attacker can exploit the vulnerability and potentially gain unauthorized access to sensitive information.
This vulnerability can be exploited by tricking a logged-in user of NASA Open MCT into visiting a malicious website or clicking on a specially crafted link. Once the user performs the action, the attacker can carry out unauthorized actions on behalf of the user, potentially leading to the exposure of sensitive information.
The impact of this vulnerability is the potential exposure of sensitive information. By exploiting the CSRF vulnerability in NASA Open MCT, an attacker can view sensitive data without proper authorization, compromising the confidentiality of the information.
To protect yourself from this vulnerability, it is recommended to update your NASA Open MCT installation to the latest version, which includes the necessary security patches. Additionally, avoid visiting untrusted websites or clicking on suspicious links while logged into Open MCT, and enable CSRF protection mechanisms in your web browser.
References
Related vulnerabilities
Recent vulnerabilities recorded for openmct.
