CVE-2024-56517: LGSL Package Reflected XSS Vulnerability in lgsl_list.php
Summary
CVE-2024-56517: LGSL has a reflected XSS at /lgsl_files/lgsl_list.php. Affects tltneon/lgsl versions < 6.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The LGSL (Game Server List) package, version 6.2.1, is a PHP-based tool designed to provide a comprehensive list of game servers and their statuses. It allows users to monitor and manage game servers efficiently. However, this package is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which can compromise the security of applications utilizing this package.
Vulnerability Detail
A reflected XSS vulnerability exists in the 'Referer' HTTP header of LGSL v6.2.1. This vulnerability allows attackers to inject arbitrary JavaScript code that is reflected in the HTML response without proper sanitization. When a crafted malicious input is provided in the 'Referer' header, it is echoed back into an HTML attribute in the application’s response, leading to potential execution of malicious scripts in the user's browser.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization for the 'Referer' header in your application to prevent the execution of malicious scripts. For example, you can modify the code to check for valid input before processing the 'Referer' header.
Conclusion
The LGSL package version 6.2.1 is vulnerable to a reflected XSS attack due to improper handling of the 'Referer' HTTP header. It is crucial to update the package to a patched version to protect against potential exploitation. Implementing input validation can serve as a temporary measure until an update can be applied.
See every vulnerability recorded for tltneon/lgsl →
FAQ
A reflected XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then executed in the user's browser when they visit a crafted URL.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your composer.lock file to Vulert's playground, you can check if your application is affected by this vulnerability.
The potential impacts include unauthorized access to sensitive information, session hijacking, and the execution of malicious actions on behalf of the user.
Yes, a patch is available. Updating the LGSL package to a version later than 6.2.1 will resolve this vulnerability.
If an immediate update is not possible, implement input validation and sanitization for the 'Referer' header as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tltneon/lgsl.
