PT-2024-32803 · Unknown · Minecraft Motd Parser

Krymonota · Published 2024-10-04 · Updated 2024-11-13 · CVE-2024-47765

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Minecraft MOTD Parser versions prior to 1.0.6

Description The HtmlGenerator class in the Minecraft MOTD Parser library is subject to a potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD. An attacker can make malicious inputs to the color and text properties of MotdItem to inject their own HTML into a web page during web page generation. This can be done by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the HtmlGenerator. The XSS vulnerability exists because the values of these properties are neither filtered nor escaped. This issue can potentially affect players visiting Minecraft server list websites, users visiting Minecraft server status websites, and server owners managing their Minecraft server via a web interface that displays the MOTD.

Recommendations For versions prior to 1.0.6, upgrade the Minecraft MOTD Parser library to version 1.0.6 or later to mitigate the risk of XSS attacks. As a temporary workaround, consider implementing input validation and escaping for the color and text properties of MotdItem to prevent malicious HTML injection. Restrict access to the HtmlGenerator class until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-47765

GHSA-Q898-FRWQ-F3QP

Affected Products

Minecraft Motd Parser

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47765.json · Exploit
• https://github.com/jgniecki/MinecraftMotdParser/commit/b0ab9d68a964cd3d74977f39a9e7af0a94509f7c · Patch
• https://github.com/jgniecki/MinecraftMotdParser/security/advisories/GHSA-q898-frwq-f3qp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q898-frwq-f3qp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47765 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47765 · Vendor Advisory
• https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49 · Note
• https://github.com/jgniecki/MinecraftMotdParser · Note
• https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80 · Note
• https://twitter.com/oktsec/status/1842242743566811439 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1842242731638202498 · Twitter Post
• https://t.me/cvenotify/101529 · Telegram Post
• https://t.me/cvedetector/6991 · Telegram Post
• https://twitter.com/CVEnew/status/1842211689443541160 · Twitter Post