CVE-2024-47765: Minecraft MOTD Parser XSS Vulnerability in dev-lancer/minecraft-motd-parser
Summary
CVE-2024-47765: Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS. Affects dev-lancer/minecraft-motd-parser versions < 1.0.6. Fixed in 1.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The dev-lancer/minecraft-motd-parser is a PHP library designed to parse the Message of the Day (MOTD) from Minecraft servers. This library allows server owners to customize their server's appearance in the multiplayer server list by sending a MOTD in the Status Response packet. The library's HtmlGenerator class converts the parsed MOTD into an HTML string for display on web pages. However, this functionality exposes the library to potential cross-site scripting (XSS) attacks due to improper handling of user input.
Vulnerability Detail
The vulnerability arises from the HtmlGenerator class, which does not adequately filter or escape the 'color' and 'text' properties of the MotdItem objects. An attacker can exploit this by sending a malicious MOTD containing HTML or JavaScript code, which gets executed in the browser when the HTML string is rendered. This can lead to unauthorized actions being performed on behalf of the user, potentially compromising user data and security. The vulnerability is classified as XSS (CWE-79) and has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.0.6
This is the first release that contains the fix.
composer require dev-lancer/minecraft-motd-parser:1.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, a temporary workaround is to manually sanitize the MOTD input before it is processed by the HtmlGenerator. For example, you can use the following code to escape potentially harmful characters: $safeMotd =
htmlspecialchars($motdInput, ENT_QUOTES, 'UTF-8');
Conclusion
The dev-lancer/minecraft-motd-parser library has a critical XSS vulnerability that can be exploited through malicious MOTD inputs. It is essential to update to the latest version to mitigate this risk. Additionally, users should consider implementing input sanitization as a temporary measure until the update can be applied.
See every vulnerability recorded for dev-lancer/minecraft-motd-parser →
FAQ
CVE-2024-47765 is a cross-site scripting (XSS) vulnerability found in the dev-lancer/minecraft-motd-parser PHP library, which can allow attackers to inject malicious scripts into web pages.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your composer.lock file.
Exploiting this vulnerability can lead to unauthorized actions being performed in the context of the user's browser, potentially compromising sensitive information and user security.
To fix the vulnerability, update the dev-lancer/minecraft-motd-parser package to version 1.0.6 or later using Composer with the command: composer update dev-lancer/minecraft-motd-parser.
If an immediate update is not feasible, sanitize the MOTD input using htmlspecialchars to prevent XSS attacks until you can apply the official patch.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
