CVE-2020-15231: XSS in Mapfish Print relating to JSONP support
Summary
CVE-2020-15231: XSS in Mapfish Print relating to JSONP support. Affects org.mapfish.print:print-lib versions < 3.24. Fixed in 3.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mapfish Print is an open-source Java library for generating printable maps. It provides a servlet-based web service that allows users to create and customize map layouts. The library supports JSONP (JSON with Padding) to enable cross-domain communication. However, a vulnerability in the JSONP support allows an attacker to perform a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from improper handling of user-supplied data in the JSONP callback function. An attacker can exploit this by injecting malicious scripts into the JSONP response, which will be executed in the context of the victim's browser. This can lead to various consequences, such as stealing sensitive information, session hijacking, or delivering malware to the user's system.
How To Fix
Minimum fixed version
3.24
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to a patched version of the Mapfish Print library.
Conclusion
The XSS vulnerability in Mapfish Print's JSONP support can have severe consequences, including data theft and malware delivery. It is crucial to upgrade to a patched version of the library (3.24 or later) to mitigate this risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.mapfish.print:print-lib →
FAQ
Mapfish Print is a Java library for generating printable maps and provides a servlet-based web service for map layout customization.
JSONP (JSON with Padding) is a technique that allows cross-domain communication by wrapping JSON data in a callback function.
The vulnerability arises from improper handling of user-supplied data in the JSONP callback function, allowing an attacker to inject malicious scripts.
The vulnerability can lead to cross-site scripting (XSS) attacks, enabling an attacker to steal sensitive information, hijack user sessions, or deliver malware.
To fix this vulnerability, upgrade to version 3.24 or later of the Mapfish Print library, which includes proper sanitization and validation of user input.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.mapfish.print:print-lib.
