How I Found DOM XSS in NASA | Bug Bounty Story

Hello👋🏽, Hacker! This Is Karthik With Another Bug Bounty Finding

During February 2025, while scrolling through LinkedIn, I noticed a post about NASA sending appreciation letters to hackers who find vulnerabilities in their systems. I was instantly shocked and thought about trying to participate in NASA’s bug bounty program.

I Googled NASA’s bug bounty program and noticed that it was hosted on Bugcrowd. At that time, I was less active in bug bounty hunting because of my startup work and other projects. Anyway, I decided to give it a try.

Whenever I start hunting on a program, I always keep my data well organized because we never know when we might end up finding a bug. Until then, we need to keep working on the same program.

I always start by creating a separate folder:

    mkdir ~/recon/nasa/
    

If I use my GhostRecon tool, it will create the folder for me.

Breaking Down My Reconnaissance Workflow

I have my own VPS running GhostRecon , a tool I developed for web reconnaissance. I have published this project on GitHub, so if you have time, go and check it out.

Due to some personal work, I haven't been able to maintain the tool properly. Anyway, I promise I'll update and publish the tool with more features. Maybe by the time you're reading this, I may have updated it!

A small note about GhostRecon: it's simply a replica of my reconnaissance methodology. I created this tool to interact with a UI and perform automated reconnaissance. So, this isn't a mandatory tool for starting bug bounty hunting, but it makes your work easier. That's all!

If you don't want to use my tool but want to understand the workflow GhostRecon follows or the methodology I use, here's how I start.

My reconnaissance workflow looks like this:

• Subdomain discovery.
• Recursive subdomain discovery, going as deep as possible.
• Loading all the collected data to discover open ports.
• Filtering active websites running HTTP/HTTPS.
• Scanning for web services running on different ports.
• Web crawling.

One important thing: don't always focus only on ports 80 and 443. Sometimes, HTTP services run on ports such as 8080, 9090, 8888, and other ports. So, scan the relevant ports as well.

Anyway, as I mentioned, I performed this entire process using GhostRecon. Meanwhile, I also tested the functionality of the discovered subdomains for authentication bypasses, injection attacks, contact forms, and other common vulnerabilities.

After a few days of deep reconnaissance and testing for many common bugs, nothing worked out.😖

The Interesting Discovery

So, I kept checking each subdomain and the crawled data stored in my text files.

While randomly scrolling through the data, I noticed these URLs:

1. https://xxx.example.nasa.gov/siteminderagent
2. https://xxx.example2.nasa.gov/siteminderagent
3. https://xxx.example3.nasa.gov/siteminderagent
4. https://xxx.example4.nasa.gov/siteminderagent

I noticed multiple subdomains containing the /siteminderagent endpoint.

I had already found a DOM XSS bug in Nokia involving the same endpoint. Let me explain why this caught my attention.

💡 Tip: Whenever you see a technology-related word in an endpoint, such as /siteminder, /sap, /realms, /wp-admin, /cpanelwebcall, or /Citrix/, you need to pay more attention because you might find an interesting vulnerability or even a CVE.

These endpoints can indicate that the target application uses a particular software product or technology. If you're unfamiliar with it, don't worry. Just Google it or use an AI tool to understand what it is.

For example, you can ask:

    "What is this? I commonly see siteminderagent in my website URLs." 
        

It may explain the technology, what it's used for, and how it works. Then, search for existing vulnerabilities associated with that specific technology.

Anyway, I've mentioned a few keywords that I commonly look for. With more experience, you'll learn to recognize more of these endpoints. Even if you're a beginner, don't worry. If you're ready to ask Google or an AI tool for help, you can learn these things easily.

Why Did SiteMinder Catch My Attention?

Coming back to my finding, as I already mentioned, I had previously found DOM XSS in Nokia because Nokia also used SiteMinder.

What is SiteMinder?

CA SiteMinder is an enterprise web access management (WAM) solution by Broadcom that provides authentication, authorization, and Single Sign-On (SSO) for web applications.

It helps organizations control user access to protected resources and integrate applications with centralized identity management systems.

Why Does It Have a DOM XSS Vulnerability?

To understand SiteMinder-related XSS vulnerabilities in more depth, I strongly recommend reading this article:

Reviving Old CVEs: Reflected XSS in CA SiteMinder :
https://blog.reigningshells.com/2019/12/reviving-old-cves-reflected-xss-in-ca.html

Testing NASA for XSS

Okay, now let's see whether we can find XSS in NASA using the SiteMinder endpoint. If we're lucky, we might find something!

I crafted a payload using the following URL:

    https://www.orbitaldebris.jsc.nasa.gov/siteminderagent/forms/smpwservices.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm\u0028\u0027POC%20By%20karthithehacker\u0027\u0029\u0022\u003e&SMAUTHREASON=7  

I opened it in my browser. Guess what? It worked!

POC Image

POC video

💡 A small tip: if you see a URL containing /siteminderagent/, you can investigate whether the related SiteMinder endpoint is vulnerable by testing the relevant password-service form and its parameters within your authorized scope.

The endpoint I tested was:

  /siteminderagent/forms/smpwservices.fcc      
    

Then, I reported the vulnerability to NASA through Bugcrowd on 8 March 2025, at 07:52:38 AM IST (Indian Standard Time, UTC+5:30).

There are the report details:

1. Target: nasa.gov
2. Vulnerable host: www.orbitaldebris.jsc.nasa.gov
3. Reported date: 8 March 2025, 02:22:38 GMT
4. hVulnerability classification: Cross-Site Scripting (XSS), reported as DOM XSS
5. Vulnerability category: Reflected XSS(DOM)
6. Priority: P3

On 10 March 2025, at 04:16:55 GMT, the Bugcrowd triager informed me that the submission was a duplicate. Unfortunately, there was no reward, no points, and no Hall of Fame recognition. Anyway, that's part of bug bounty hunting! Not every finding results in a reward, but every experience teaches us something.

After approximately one year, the issue has now been fixed, so I'm disclosing my finding in this write-up.

This was an interesting experience, from discovering the SiteMinder endpoint during reconnaissance to testing it and submitting the report to NASA's bug bounty program.

Final Words

If you like my content and write-ups, give me a follow and subscribe to my social media accounts and YouTube channel.

Stay curious, keep learning, and happy hacking!