PT-2026-95102 · Mapserver · Mapserver
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
MapServer versions 6.0 through 8.6.3
Description
MapServer's OpenLayers HTML output for the endpoint
SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP X FORWARDED HOST through the functions msBuildOnlineResource(), processLine(), and the [mapserv onlineresource] substitution in src/maputil.c and src/maptemplate.c without proper escaping for a single-quoted JavaScript string. If the deployment trusts the forwarded header and lacks a fixed ows onlineresource or MS ONLINERESOURCE value, embedded single quotes can escape the generated URL string. This allows an unauthenticated attacker to execute arbitrary JavaScript in the MapServer site origin, potentially granting access to sessions, tokens, same-origin data, and requests.Recommendations
Update to version 8.6.4.
Configure a fixed
ows onlineresource or MS ONLINERESOURCE value to prevent the use of the forwarded header.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mapserver