DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
Date: 2024-06
Affected: maven/org.dspace:dspace-server-webapp
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2024-38364
CWE: CWE-79
CVSS: 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L)

### Impact In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser _may_ execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This attack may only be initialized by a user who already has Submitter privileges in the repository. The submitter must upload the malicious HTML/XML/JavaScript file themselves. The attack itself would not occur until a visitor or logged-in user downloads the file or clicks on a download link shared by the attacker. If your site is running the frontend and backend from separate domains, CORS and CSRF protection built into DSpace help to limit the impact of the attack. If the repository is configured to only download HTML / XML / JavaScript Bitstreams using the [`Content-Disposition: attachment`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition) header, then the attack is no longer possible. See "Workarounds" below. ### Patches The fix is included in both 8.0 and 7.6.2. Please upgrade to one of these versions, or manually apply one of the "Workarounds" below. If you are already running 7.6 or 7.6.1, then this vulnerability can be fixed via a configuration update in your `dspace.cfg` configuration file. See details in below. ### Workarounds **DSpace sites running 7.6 or 7.6.1** can fix this issue by adding the following `webui.content_disposition_format` settings to their `dspace.cfg` (or `local.cfg`). These


Mitigations:

Architectural layers (MAESTRO):