MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host HTTP header value without proper escaping in JavaScript single-quoted strings. This occurs through the msBuildOnlineResource(), processLine(), and [mapserv_onlineresource] substitution mechanisms in the source code. When the deployment trusts the forwarded header and does not configure fixed ows_onlineresource or MS_ONLINERESOURCE values, an attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin. This vulnerability affects versions from 6.0 until 8.6.4 and is resolved in 8.6.4.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the victim's browser when visiting a crafted URL. This enables theft of session tokens, access to same-origin data and requests, and performing actions on behalf of the victim within the MapServer site origin. The impact is a cross-site scripting (XSS) vulnerability leading to potential account compromise or unauthorized actions.

This vulnerability is fixed in MapServer version 8.6.4. Users should upgrade to version 8.6.4 or later to remediate this issue. If upgrading is not immediately possible, ensure that the deployment does not trust the X-Forwarded-Host header by configuring fixed values for ows_onlineresource or MS_ONLINERESOURCE to prevent injection of attacker-controlled values. No other specific mitigations are indicated.