Cross-site scripting attack in mapfish-print
Description
In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.mapfish.print:print-libMaven | < 3.24 | 3.24 |
org.mapfish.print:print-servletMaven | < 3.24 | 3.24 |
org.mapfish.print:print-standaloneMaven | < 3.24 | 3.24 |
Affected products
4- ghsa-coords3 versionspkg:maven/org.mapfish.print/print-libpkg:maven/org.mapfish.print/print-servletpkg:maven/org.mapfish.print/print-standalone
< 3.24+ 2 more
- (no CPE)range: < 3.24
- (no CPE)range: < 3.24
- (no CPE)range: < 3.24
- Range: < 3.24
Patches
Vulnerability mechanics
Root cause
"The server reflected the unsanitized `jsonp` query parameter into the HTTP response body, enabling reflected Cross-site Scripting."
Attack vector
An attacker can craft a URL to any of the affected endpoints (e.g., `/print/status/ref.json?jsonp=alert(1)`) and trick a victim into visiting it. The server reflects the `jsonp` parameter value directly into the HTTP response body wrapped as a JavaScript function call, allowing arbitrary script execution in the victim's browser. This is a classic reflected Cross-site Scripting (XSS) attack [CWE-79] that requires no authentication and can be triggered via any web page or email link.
Affected code
The vulnerability resides in `MapPrinterServlet.java` where multiple endpoints (`getStatus`, `listAppIds`, `getCapabilities`, `getExampleRequest`) accepted a `jsonp` callback parameter and reflected it into the response without sanitization. The patch removes the JSONP callback parameter from all these methods and deletes the associated `appendJsonpCallback`/`appendJsonpCallbackEnd` helper calls, as shown in the diff for `core/src/main/java/org/mapfish/print/servlet/MapPrinterServlet.java` [patch_id=6634927].
What the fix does
The patch removes the `jsonp` request parameter from every endpoint (`getStatus`, `listAppIds`, `getCapabilities`, `getExampleRequest`) and deletes the `appendJsonpCallback`/`appendJsonpCallbackEnd` helper methods that wrapped the response in a user-controlled function call. By eliminating JSONP support entirely, the server no longer reflects attacker-controlled callback names into the response body, which closes the XSS vector [patch_id=6634927]. The corresponding test methods that verified JSONP behavior were also removed.
Preconditions
- inputThe attacker must trick a victim into visiting a crafted URL to the mapfish-print server
- authNo authentication or special configuration is required
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-w534-q4xf-h5v2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15231ghsaADVISORY
- github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5eghsax_refsource_MISCWEB
- github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.