CVE-2026-66300: Snowstorm XSS Vulnerability

CVE-2026-66300 Overview

CVE-2026-66300 is a reflected Cross-Site Scripting (XSS) vulnerability in SNOMED International Snowstorm, the terminology server used to host and query SNOMED CT clinical terminology data. The flaw resides in the /web-route redirection endpoint implemented by WebRouteController.java. When the endpoint receives a malformed uri parameter, the resulting IllegalArgumentException message is reflected in the response body. An attacker-controlled Accept header causes Spring to serialize that response as Content-Type: text/html, allowing injected JavaScript to execute in the victim's browser. The issue is tracked as [CWE-79] and is fixed in Snowstorm versions 10.12.2 and 10.9.3.

Critical Impact
Successful exploitation executes attacker-supplied JavaScript in the context of the Snowstorm application, enabling session theft, credential harvesting, or unauthorized actions against clinical terminology data.

Affected Products

SNOMED International Snowstorm versions prior to 10.12.2 (10.12.x branch)
SNOMED International Snowstorm versions prior to 10.9.3 (10.9.x branch)
Deployments exposing the /web-route redirection endpoint to untrusted users

Discovery Timeline

2026-08-04 - CVE-2026-66300 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-66300

Vulnerability Analysis

Snowstorm exposes a redirection helper at GET /web-route through the issueRedirect handler in WebRouteController.java. The handler accepts a user-supplied uri query parameter and delegates URL resolution to webRoutingService.determineRedirectionString. When resolution fails, the original implementation caught IllegalArgumentException and returned the exception's toString() value in a ResponseEntity<?> body with HTTP 400 Bad Request.

Because the response type was a raw String, Spring performed content negotiation based on the client-controlled Accept header. A request advertising Accept: text/html caused Spring to emit Content-Type: text/html, meaning any reflected characters from the malicious uri were rendered as markup by the browser. This turned a validation error into a reflected XSS sink.

Root Cause

The root cause is unsafe reflection of untrusted input into an HTML-negotiable response body. The controller mixed two concerns: business logic (redirection) and error rendering. By returning e.toString() directly, the endpoint exposed the attacker's uri value verbatim, and by declaring ResponseEntity<?>, it deferred serialization decisions to Spring's Accept-driven negotiation. This is a textbook [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the Snowstorm HTTP interface and social engineering to have a target user click a crafted link. The attacker constructs a URL of the form /web-route?uri=<payload> where <payload> contains HTML/JavaScript that will trigger IllegalArgumentException inside determineRedirectionString. The request must include an Accept: text/html header so Spring renders the reflected error as HTML. When the victim follows the link, the injected script executes in the origin of the Snowstorm application.

java

// Patched issueRedirect handler from WebRouteController.java
@GetMapping(value = "/web-route")
@CrossOrigin
public ResponseEntity<Void> issueRedirect(@RequestParam String uri,
        @RequestParam(required = false) String _format,
        @RequestHeader(value = "Accept", required = false) String acceptHeader) throws URISyntaxException {
    // IllegalArgumentException is intentionally left to propagate to RestControllerAdvice, which renders it
    // as JSON. Reflecting the raw, attacker-supplied uri in a String response here previously allowed the
    // request's Accept header to make Spring emit Content-Type: text/html, turning it into a reflected XSS.
    String redirectionStr = webRoutingService.determineRedirectionString(uri, acceptHeader, _format);
    HttpHeaders headers = new HttpHeaders();
    headers.add("Access-Control-Allow-Headers", "x-requested-with, Content-Type");
    headers.setLocation(new URI(redirectionStr));
    return new ResponseEntity<>(headers, HttpStatus.FOUND);
}
// Source: https://github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39

The patch removes the local try/catch and changes the return type to ResponseEntity<Void>. Exceptions now propagate to RestControllerAdvice, which serializes errors as structured JSON or XML rather than reflecting attacker input in an HTML-negotiated body.

Detection Methods for CVE-2026-66300

Indicators of Compromise

Requests to /web-route containing HTML tags, <script>, javascript:, or common XSS payload markers in the uri query parameter.
HTTP requests to /web-route combined with an Accept: text/html header targeting an API endpoint that would normally be consumed programmatically.
HTTP 400 Bad Request responses from Snowstorm with Content-Type: text/html that echo query parameter content.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the uri parameter of /web-route for encoded and raw HTML/JavaScript payloads.
Correlate application logs for repeated IllegalArgumentException traces originating in WebRouteController.issueRedirect alongside browser-like User-Agent strings.
Alert on outbound requests from user browsers that fetch /web-route with reflected payload signatures, indicating a successful click on a crafted link.

Monitoring Recommendations

Enable verbose request logging on the Snowstorm reverse proxy and forward events to a centralized log platform for retention and query.
Monitor for anomalous spikes in /web-route traffic, especially from external referrers or unexpected geographies.
Track authentication events immediately following /web-route responses to detect session hijack attempts leveraging stolen cookies.

How to Mitigate CVE-2026-66300

Immediate Actions Required

Upgrade Snowstorm to version 10.12.2 (10.12.x branch) or 10.9.3 (10.9.x branch), which contain the fix committed in 575b555 and b8061ad.
Restrict network exposure of the /web-route endpoint to trusted internal consumers where feasible until patching is complete.
Invalidate active user sessions after upgrading to remove any tokens that may have been exposed prior to remediation.

Patch Information

The fix is applied in src/main/java/org/snomed/snowstorm/rest/WebRouteController.java under maintenance ticket MAINT-3110. It removes the reflected String error body and delegates exception rendering to Spring's RestControllerAdvice, which returns structured JSON or XML. See the upstream commits at IHTSDO/snowstorm commit 575b555 and IHTSDO/snowstorm commit b8061ad. Advisory metadata is available in the CISA CSAF document va-26-212-01 and the CVE.org record for CVE-2026-66300.

Workarounds

Configure the reverse proxy or WAF to block requests to /web-route where the Accept header includes text/html, forcing JSON or XML negotiation.
Add a Content-Security-Policy response header with a strict script-src directive to limit script execution even when reflected input reaches the browser.
Filter /web-routeuri parameter values at the proxy layer to reject characters commonly used in XSS payloads such as <, >, and ".

bash

# Example NGINX rule to block HTML-negotiated requests to the vulnerable endpoint
location /web-route {
    if ($http_accept ~* "text/html") {
        return 406;
    }
    proxy_pass http://snowstorm_backend;
}