CVE-2026-39379 in GeoNetwork
Summary
by MITRE • 11/03/2026
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
GeoNetwork serves as a robust catalog application designed for managing spatially referenced resources, facilitating the discovery and sharing of geospatial data across various platforms. Within specific legacy releases ranging from version 3.0.0 through 4.2.15 and up to 4.4.10, the software exhibits a critical security flaw rooted in its handling of user-supplied input within error pages generated for nonexistent or unauthorized service URLs. This vulnerability stems from an improper neutralization of special elements used in web templates, specifically affecting the AngularJS framework integrated into the application's frontend architecture. When a remote attacker crafts a malicious link targeting these specific URL endpoints, the resulting HTTP response includes an error page that reflects the attacker-controlled request content directly back to the client without adequate sanitization or encoding for template evaluation contexts.
The core technical flaw lies in how the AngularJS engine processes this reflected input. Because the application fails to properly escape special characters before injecting them into the HTML structure, the browser interprets the injected payload as part of an active AngularJS expression rather than static text data. This behavior creates a classic Reflected Cross-Site Scripting scenario where the malicious script is executed immediately upon page load within the context of the victim's authenticated session. The vulnerability allows for arbitrary JavaScript execution because AngularJS provides powerful templating capabilities that can be abused to access internal objects and functions if the sandbox restrictions are bypassed using known escape techniques. Consequently, an attacker does not need complex social engineering beyond inducing a user or administrator to click a crafted link; once opened, the malicious code runs with the same privileges as the legitimate application logic.
The operational impact of this vulnerability is severe due to its potential for full session hijacking and unauthorized administrative actions. An authenticated victim, particularly an administrator with elevated privileges in GeoNetwork, becomes susceptible to complete compromise of their browser session state. The attacker can exfiltrate sensitive data such as authentication tokens, cookies, or personally identifiable information stored within the application interface. Furthermore, the ability to execute arbitrary JavaScript enables the perpetrator to perform actions on behalf of the victim, including modifying catalog entries, deleting spatial resources, or accessing restricted services that would otherwise be inaccessible. This effectively undermines the integrity and confidentiality guarantees provided by GeoNetwork’s access control mechanisms, turning a simple link click into a vector for significant data breach and system manipulation.
To mitigate this risk, organizations running affected versions of GeoNetwork must prioritize immediate upgrading to version 4.2.15 or 4.4.10, where the input validation logic has been corrected to ensure proper neutralization of special elements before template evaluation occurs. For environments unable to upgrade immediately due to operational constraints, implementing a Web Application Firewall with rules capable of detecting and blocking AngularJS-specific injection patterns can provide temporary protection against exploitation attempts. Additionally, enforcing strict Content Security Policy headers that restrict the execution of inline scripts and limit source origins for script loading can significantly reduce the blast radius if an injection attempt occurs by preventing the browser from interpreting malicious payloads as executable code. Regular security audits focusing on input validation in error handling routines are also recommended to prevent similar flaws in future development cycles, aligning with industry standards such as CWE-79 which addresses improper neutralization of input during web page generation and MITRE ATT&CK technique T1059 regarding command and script interpretation through browser-based vectors.