ZOO-Project Web Processing Service Reflective Cross-Site Scripting Vulnerability

A reflected Cross-Site Scripting vulnerability has been identified in the ZOO-Project Web Processing Service (WPS) publish.py CGI script, affecting versions prior to 7a5ae1a. The vulnerability arises because the script reflects user input from the 'jobid' parameter in the HTTP response without adequate HTML encoding or sanitization. This flaw allows attackers to execute arbitrary JavaScript in the context of the victim's browser. The issue is exacerbated by the fact that this endpoint is accessible from the main WPS interface, potentially facilitating phishing attacks against WPS users.

Impact

Exploitation of this vulnerability allows for the execution of injected JavaScript in the context of the victim's browser, with access to their WPS session and cookies. This could lead to the theft of sensitive information or unauthorized actions on behalf of the user.

Reproduction

To reproduce this vulnerability, access the vulnerable 'publish.py' CGI endpoint and inject a script payload into the 'jobid' parameter. When the crafted URL is visited, the injected script will execute in the browser.

Remediation

Users are advised to update to version 7a5ae1a or later, where this vulnerability has been fixed. Additionally, implement proper HTML encoding of user inputs, add Content-Security-Policy headers to restrict inline script execution, and validate and sanitize user input parameters.