Attack Chain

1. Craft Malicious URL: The attacker crafts a specific URL that targets a non-existent or unauthorized GeoNetwork service endpoint, embedding client-side template injection payloads (e.g., {{expression}}) within the path or query parameters.
2. Phishing Delivery: The attacker delivers this crafted malicious URL to a victim, typically via social engineering tactics such as phishing emails, instant messages, or compromised web pages, enticing the victim to click the link.
3. Victim Request: The victim, interacting with the lure, clicks the malicious URL, causing their web browser to send an HTTP GET request containing the embedded payload to the vulnerable GeoNetwork server.
4. Server Error Response: The GeoNetwork server processes the request for the invalid service. Due to its design, it generates an AngularJS-based error page that reflects portions of the original, unsanitized request URL back to the client.
5. Client-Side Template Evaluation: When the victim's browser receives and renders the error page, the AngularJS framework identifies the reflected attacker-controlled content as a template expression. It then evaluates this expression.
6. Arbitrary JavaScript Execution: The evaluation of the template expression results in the execution of the attacker's arbitrary JavaScript code within the context of the victim's browser.
7. Impact on Authenticated Session: The malicious JavaScript executes with the same permissions and within the same authenticated session as the victim user, potentially allowing for session hijacking, data exfiltration from GeoNetwork, or performing unauthorized actions on the victim's behalf.
8. Further Exploitation: The attacker leverages the executed JavaScript to achieve their objective, which could include redirecting the user to a fake login page for credential harvesting or initiating further attacks against the GeoNetwork instance.

Impact

Successful exploitation of CVE-2026-39379 allows an attacker to execute arbitrary JavaScript code within the victim's browser. This code runs in the context of the victim's authenticated session, enabling severe consequences such as session hijacking, unauthorized data exfiltration from the GeoNetwork instance, or performing actions on the victim's behalf, including modifying content or changing configurations if the victim is an administrator. Additionally, attackers could inject fake login forms or malicious content to harvest credentials or spread malware. GeoNetwork versions 3.x and 4.0.x are particularly at risk as they are archived and will not receive official fixes, necessitating immediate upgrades for affected organizations.

Recommendation

• Patch CVE-2026-39379 immediately by upgrading GeoNetwork to a fixed version (4.2.15 or later, or 4.4.10 or later).
• Deploy the Sigma rule "Detects CVE-2026-39379 Exploitation - GeoNetwork Reflected XSS Attempt" to your SIEM to identify attempts at client-side template injection via web server logs.