PT-2024-36827 · Lgsl · Lgsl

Tcu0N9 · Published 2024-12-30 · Updated 2024-12-30 · CVE-2024-56517

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LGSL (Live Game Server List) versions up to and including 6.2.1

Description The issue is related to a reflected cross-site scripting vulnerability in the Referer HTTP header. This vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response without proper sanitization. When crafted malicious input is provided in the Referer header, it is echoed back into an HTML attribute in the application’s response. The vulnerability is present in the /lgsl files/lgsl list.php endpoint, specifically in the lines where the $uri variable is set based on the HTTP REFERER header.

Recommendations For LGSL (Live Game Server List) versions up to and including 6.2.1, update to a version that includes the patch commit 7ecb839df9358d21f64cdbff5b2536af25a77de1 to resolve the issue. As a temporary workaround, consider restricting access to the /lgsl files/lgsl list.php endpoint to minimize the risk of exploitation. Avoid using the Referer header with untrusted input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56517

GHSA-GGWQ-XC72-33R3

Affected Products

Lgsl

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56517.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56517 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56517 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ggwq-xc72-33r3 · Vendor Advisory
• https://github.com/tltneon/lgsl/commit/7ecb839df9358d21f64cdbff5b2536af25a77de1 · Note
• https://github.com/tltneon/lgsl/security/advisories/GHSA-ggwq-xc72-33r3 · Note
• https://github.com/tltneon/lgsl/blob/master/lgsl_files/lgsl_list.php#L20-L24 · Note
• https://github.com/tltneon/lgsl · Note
• https://twitter.com/VulmonFeeds/status/1873791806283841993 · Twitter Post
• https://twitter.com/CVEnew/status/1873773810949755116 · Twitter Post
• https://t.me/cvedetector/13940 · Telegram Post