CVE-2026-54355: MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResource(), processLine(), and the [mapservonlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed owsonlineresource or MSONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MapServerto a version that resolves this vulnerability.Fixed in 8.6.4 - Configuration
Do not rely on the trusted forwarded header for MapServer OpenLayers WMS GetMap online resource generation; configure a fixed ows_onlineresource or MS_ONLINERESOURCE value so attacker-controlled HTTP_X_FORWARDED_HOST is not reflected into the single-quoted JavaScript URL string (affected versions: 6.0 through 8.6.4).
MapServer ows_onlineresource / MS_ONLINERESOURCE = Set to a fixed (non-forwarded-header-derived) value
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Exposure requires a deployment that trusts the X-Forwarded-Host header and has not configured a fixed ows_onlineresource or MS_ONLINERESOURCE value. The affected output is the OpenLayers HTML response generated by a WMS GetMap request with FORMAT=application/openlayers.
What does an attacker need to exploit this issue?
An attacker does not need authentication. They need to cause a victim to open a crafted URL and need control of an X-Forwarded-Host value that MapServer accepts through the trusted forwarding configuration.
What can be done before upgrading?
Configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, and do not trust attacker-controlled forwarded host headers. This prevents the vulnerable reflected header value from being used to build the generated URL.
How can I determine whether an instance is affected?
Check whether the instance is running a version from 6.0 through before 8.6.4, serves WMS GetMap responses using FORMAT=application/openlayers, trusts X-Forwarded-Host, and lacks a fixed ows_onlineresource or MS_ONLINERESOURCE setting.