CVE-2024-47765 Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS
An attacker can inject malicious HTML into web pages via crafted Minecraft MOTD data processed by the HtmlGenerator class in this PHP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47765?
CVE-2024-47765 is a medium-severity cross-site scripting vulnerability in jgniecki MinecraftMotdParser, published on 4 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD. The HtmlGenerator iterates through objects of MotdItem that are contained in an object of MotdItemCollection to generate a HTML string. An attacker can make malicious inputs to the color and text properties of MotdItem to inject own HTML into a web page during web page generation. For example by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the HtmlGenerator. This XSS vulnerability exists because the values of these properties are neither filtered nor escaped. This vulnerability is fixed in 1.0.6.
Which versions are affected by CVE-2024-47765?
2 open source packages ship an affected version, including dev-lancer/minecraft-motd-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dev-lancer/minecraft-motd-parser Packagist | All versions | 1.0.6 |
dev-lancer/minecraft-motd-parser Packagist | All versions | 1.0.6 |
Products include Jgniecki Minecraft Motd Parser.
How do I fix CVE-2024-47765?
Upgrade dev-lancer/minecraft-motd-parser to 1.0.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47765 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47765 exists.
Sources
Also known as GHSA-q898-frwq-f3qp.