NASA Fprime Template Injection Vulnerability Allowing Remote Code Execution

A template injection vulnerability has been identified in the Dashboard of NASA Fprime version 3.4.3. This vulnerability allows attackers to execute arbitrary code by uploading a specially crafted Vue file. The issue arises because user input is directly inserted into a Vue template without proper sanitization, enabling the execution of malicious scripts.

Impact

Exploitation of this vulnerability allows for remote code execution on the system where Fprime is running, including on spacecraft during missions.

Reproduction

To reproduce this vulnerability, upload a Vue file containing a malicious script payload through the application's file upload feature. Once the file is uploaded, the injected script will execute automatically when the dashboard is loaded, without any user interaction.