This vulnerability in OPeNDAP Hyrax allows attackers to capture Earthdata authentication tokens (User-Id and Echo-Token headers) by exploiting a gap between the URL allowlist and HTTP redirect handling. The server validates the initial URL against its AllowedHosts list but unconditionally follows redirects, meaning a request to a legitimate domain that redirects to an attacker-controlled endpoint will still have credentials sent along. This is a known vulnerability class—redirects bypassing URL validation has been documented since at least 2014 in AWS metadata SSRF research—but the pattern keeps recurring because the mental model for URL validation and HTTP request execution are typically implemented separately.
What elevates this beyond a simple bypass is the credential exposure. Earthdata tokens authenticate against NASA's broader scientific data infrastructure, not just the Hyrax server itself. The CVSS of 6.5 underweights this by treating it as information disclosure rather than credential theft with potential downstream reuse across multiple data systems.
For defenders: verify whether your Hyrax deployment uses an allowlist for outbound requests and confirm whether the HTTP client library or request handling code explicitly revalidates redirect targets against that allowlist before following them. If redirect following is built into the underlying HTTP client with no application-layer interception, the allowlist is ineffective against this vector regardless of how tightly it's configured. The fix isn't tightening the allowlist—it's architecturally intercepting redirects at the application layer and validating the final destination before the request proceeds. Check your dependency versions; the patch addresses this bypass specifically, and the presence of the allowlist in your configuration indicates you're exposed. Review legitimate data access patterns that depend on redirects before patching, as some scientific data pipelines may rely on the old behavior—document any such dependencies to avoid breaking established workflows.