MapServer 8.6.3 Reflected XSS via HTTP_X_FORWARDED_HOST (CVE-2025-54358) Analysis & POC

MapServer 8.6.3 反射型 XSS 漏洞总结 漏洞概述 漏洞名称：MapServer 8.6.3 中通过 在 OpenLayers HTML 输出中触发反射型 XSS CVE ID：CVE-2025-54358 严重等级：High（高危） 漏洞类型：反射型跨站脚本（Reflected XSS） 根本原因：MapServer 的 OpenLayers HTML 输出将 环境变量 未经 JavaScript 上下文转义直接拼接到 JavaScript 字符串中。攻击者可通过构造 请求头注入任意 JavaScript。 影响范围 受影响版本：>= 8.0 修复版本：8.6.4 影响组件：MapServer OpenLayers viewer 影响场景： - MapServer 返回 OpenLayers HTML 输出 - 部署环境允许攻击者控制 头 - 攻击者通过 WMS 请求触发 - 服务未用固定值覆盖 或 触发条件 1. MapServer 返回 OpenLayers HTML 输出 2. 部署环境允许攻击者控制 头 3. 攻击者通过 WMS 请求 触发 4. 服务未用固定值覆盖生成的在线资源 修复方案 1. JavaScript 字符串转义：在将 插入 OpenLayers JavaScript 字符串字面量前进行转义 2. 优先使用固定值：优先使用固定的 或 3. 限制转发头来源：仅接受来自受信任反向代理的转发头 4. 验证转发头：在使用 、 和 构造在线资源 URL 前，先验证其是否包含换行符或特殊字符 POC 代码 ```bash #!/usr/bin/env bash set -euo pipefail ROOT="${ROOT:-$(pwd)}" if [[ ! -x "${MAPSERV_BIN}" ]]; then echo "Missing built binary: ${MAPSERV_BIN}" >&2 echo "Please build MapServer first so build/mapserv exists." >&2 exit 1 fi TMP_DIR="$(mktemp -d)" trap 'rm -rf "${TMP_DIR}"' EXIT CONF="${TMP_DIR}/mapserver.conf" cat > "${TMP_DIR}/mapserver.conf" <<EOF PORT 8080 DATA "${ROOT}/misc/data" STYLE "${ROOT}/misc/data/testline.sty" WEB "ms_enable_request" "GetMap" "ms_enable_request" "GetMap" "ms_enable_request" "GetCapabilities" "ms_enable_request" "GetFeatureInfo" "ms_enable_request" "GetLegendGraphic" "ms_enable_request" "DescribeFeatureType" "ms_enable_request" "GetTileWMS" "ms_enable_request" "GetFeatureInfoWMS" "ms_enable_request" "GetFeatureInfoWFS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS" "ms_enable_request" "GetFeatureInfoWCS"

Goal Reached Thanks to every supporter — we hit 100%!

MapServer 8.6.3 Reflected XSS via HTTP_X_FORWARDED_HOST (CVE-2025-54358) Analysis & POC

More from this source