CVE-2024-56361: lgsl Stored Cross-Site Scripting Vulnerability
Summary
CVE-2024-56361: lgsl Stored Cross-Site Scripting vulnerability. Affects tltneon/lgsl versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lgsl is an open-source library designed to facilitate the querying and display of game server information. It allows users to retrieve and present data from various game servers in a structured format. The library is widely used in gaming communities for its ability to provide real-time server status and details. However, it has a critical vulnerability that stems from improper input sanitation, making it susceptible to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the function lgsl_query_40 in lgsl_protocol.php, which implements an HTTP crawler to request data from registered game servers. When a malicious payload is crawled from the /info endpoint, it can execute arbitrary JavaScript on the info page viewed by users. This can lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking. The vulnerability is classified as a stored XSS, meaning the malicious script is stored on the server and executed when users access the affected page.
How To Fix
Minimum fixed version
7.0.0
This is the first release that contains the fix.
composer require tltneon/lgsl:7.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and output encoding on the data retrieved from game servers before displaying it. For example, you can modify the affected code to ensure that any user input is properly sanitized before being rendered on the page. Here’s an example of how to encode output safely:
foreach ($server['e'] as $field => $value) {
$value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8'); // Sanitize output
$output .= "<tr><td> {$field} </td><td> {$value} </td></tr>";
}
Conclusion
The lgsl package has a critical stored XSS vulnerability (CVE-2024-56361) due to improper input sanitation. It is essential to update to version 7.0.0 or later to mitigate this risk. Implementing temporary workarounds can help protect users until the update is applied.
See every vulnerability recorded for tltneon/lgsl →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into content that is stored on a server. When users access the affected content, the script executes in their browsers, potentially compromising their data.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your composer.lock file, Vulert can alert you to any vulnerabilities, including CVE-2024-56361. You can also check your application using the Vulert playground without signing up.
If exploited, this vulnerability can lead to unauthorized actions on behalf of users, data theft, session hijacking, and a compromised user experience, potentially damaging the reputation of the application.
Yes, you can implement input validation and output encoding as a temporary measure to mitigate the risk until you can update to the patched version.
Detailed information about CVE-2024-56361 can be found on security advisory databases, GitHub advisories, and the official documentation of the lgsl package.
References
Related vulnerabilities
Recent vulnerabilities recorded for tltneon/lgsl.
