Executive brief
MapServer is a geospatial application server used to build web-based mapping and GIS applications. The OpenLayers HTML output feature fails to properly escape attacker-controlled HTTP headers, allowing an unauthenticated attacker to inject arbitrary JavaScript code that executes in the victim's browser within the MapServer origin. This enables session hijacking, token theft, and unauthorized actions on behalf of the victim.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in MapServer's WMS SERVICE=GetMap handler with FORMAT=application/openlayers. The vulnerability exists in msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution within src/maputil.c and src/maptemplate.c. The flaw fails to escape the X-Forwarded-Host HTTP header when it is reflected into a single-quoted JavaScript string without proper encoding. An unauthenticated attacker can craft a malicious URL containing embedded single quotes in the X-Forwarded-Host header to break out of the JavaScript string context and inject arbitrary code. The attack succeeds only when the MapServer deployment trusts the X-Forwarded-Host header and does not explicitly configure a fixed ows_onlineresource or MS_ONLINERESOURCE value. The vulnerability was patched in version 8.6.4.
Affected products
- OSGeo MapServer 6.0 to 8.6.3
Timeline
- 2026-09-17: disclosed
- 2026-06-01: patched: Fix committed to main branch; version 8.6.4 released
- 2026-05-31: other: Initial fix commit edc1033c