Summary
A reflected cross-site scripting vulnerability in Goobi viewer's IIIF Auth 2.0 login and token endpoints allows attacker-controlled origin values to be returned in security headers and HTML responses. When a victim follows a crafted authentication-flow link, the unescaped value may execute JavaScript in the viewer's browser.
A reflected cross-site scripting vulnerability in Goobi viewer's IIIF Auth 2.0 login and token endpoints allows attacker-controlled origin values to be returned in security headers and HTML responses. When a victim follows a crafted authentication-flow link, the unescaped value may execute JavaScript in the viewer's browser.
Affected context
The issue affects Goobi viewer deployments using the IIIF Auth 2.0 authorization flow. It occurs when the auth/login or auth/token endpoint accepts an origin query parameter without validating or contextually escaping it before placing the value in a Content-Security-Policy response header and an HTML JavaScript postMessage argument.
The issue affects Goobi viewer deployments using the IIIF Auth 2.0 authorization flow. It occurs when the auth/login or auth/token endpoint accepts an origin query parameter without validating or contextually escaping it before placing the value in a Content-Security-Policy response header and an HTML JavaScript postMessage argument.
Exploit preconditions
- Attack surface: Publicly reachable IIIF Auth 2.0 login and token endpoints
- Required access: No authenticated account may be required; the attacker must be able to send crafted authentication-flow requests to a victim
- Trigger point: Processing of the attacker-controlled
originquery parameter during login or token flow responses - Why exploitation is possible: The value is reflected into HTTP and JavaScript contexts without appropriate validation and output encoding, allowing browser-interpreted script content
- Attack surface: Publicly reachable IIIF Auth 2.0 login and token endpoints
- Required access: No authenticated account may be required; the attacker must be able to send crafted authentication-flow requests to a victim
- Trigger point: Processing of the attacker-controlled
originquery parameter during login or token flow responses - Why exploitation is possible: The value is reflected into HTTP and JavaScript contexts without appropriate validation and output encoding, allowing browser-interpreted script content
Why this happens
The underlying bug is insufficient input validation and context-sensitive output encoding. An attacker-controlled query parameter is reused in a Content-Security-Policy header and embedded in a single-quoted JavaScript postMessage argument without ensuring that it is safe for either context. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, with related concerns involving response header injection and unsafe template or script-context construction.
The underlying bug is insufficient input validation and context-sensitive output encoding. An attacker-controlled query parameter is reused in a Content-Security-Policy header and embedded in a single-quoted JavaScript postMessage argument without ensuring that it is safe for either context. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, with related concerns involving response header injection and unsafe template or script-context construction.
Potential impact
- JavaScript may execute in a victim's browser under the application's origin
- An attacker could access or alter data available to the affected web application
- Authentication-flow information or session-related data could be exposed
- Malicious scripts could perform actions through the victim's active session
- The vulnerability could undermine trust in embedded or framed viewer content
- JavaScript may execute in a victim's browser under the application's origin
- An attacker could access or alter data available to the affected web application
- Authentication-flow information or session-related data could be exposed
- Malicious scripts could perform actions through the victim's active session
- The vulnerability could undermine trust in embedded or framed viewer content
General mitigation guidance
Mitigation generally focuses on treating query parameters as untrusted data across every output context.
Common defensive patterns include:
- Allowlisting valid origins and rejecting unexpected or malformed values
- Applying context-specific encoding for HTTP headers, HTML, and JavaScript strings
- Avoiding direct interpolation into executable JavaScript and using structured data serialization instead
- Constructing security headers through validated policy objects rather than string concatenation
- Applying least privilege to browser sessions and limiting sensitive actions exposed to authenticated clients
- Adding regression tests for special characters, delimiter breaking, and cross-context injection attempts
Mitigation generally focuses on treating query parameters as untrusted data across every output context.
Common defensive patterns include:
- Allowlisting valid origins and rejecting unexpected or malformed values
- Applying context-specific encoding for HTTP headers, HTML, and JavaScript strings
- Avoiding direct interpolation into executable JavaScript and using structured data serialization instead
- Constructing security headers through validated policy objects rather than string concatenation
- Applying least privilege to browser sessions and limiting sensitive actions exposed to authenticated clients
- Adding regression tests for special characters, delimiter breaking, and cross-context injection attempts
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules that identify request parameters concatenated into HTML, JavaScript, or response headers
- Code review checks for unvalidated origin, URL, and redirect parameters
- Tests that verify rejected or safely encoded delimiter, quote, and script-like input
- Runtime monitoring for unusual authentication-flow parameters and reflected script markers
- Security policies requiring allowlisted origins and context-aware output encoding
- Automated application security testing that exercises reflected input across HTML, JavaScript, and header contexts
Organizations can look for this weakness through:
- Static analysis rules that identify request parameters concatenated into HTML, JavaScript, or response headers
- Code review checks for unvalidated origin, URL, and redirect parameters
- Tests that verify rejected or safely encoded delimiter, quote, and script-like input
- Runtime monitoring for unusual authentication-flow parameters and reflected script markers
- Security policies requiring allowlisted origins and context-aware output encoding
- Automated application security testing that exercises reflected input across HTML, JavaScript, and header contexts
