Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS
Date: 2024-10
Affected: composer/dev-lancer/minecraft-motd-parser
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-47765
CWE: CWE-79
CWE-80
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Summary The `HtmlGenerator` class is subject to potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD. ### Context Minecraft server owners can set a so-called MOTD (Message of the Day) for their server that appears next to the server icon and below the server name on the multiplayer server list of a player's Minecraft client. The Minecraft server sends the MOTD in the `description` property of the [Status Response](https://wiki.vg/Server_List_Ping#Status_Response) packet. The [jgniecki/MinecraftMotdParser](https://github.com/jgniecki/MinecraftMotdParser) PHP library is able to parse the value of the `description` property, which can be either a string or an array of text components. By utilizing the aforementioned `HtmlGenerator` class, it is also able to transform the value into an HTML string that can be used to visualize the MOTD on a web page. ### Details The `HtmlGenerator` iterates through objects of `MotdItem` that are contained in an object of `MotdItemCollection` to generate a HTML string. An attacker can make malicious inputs to the `color` and `text` properties of `MotdItem` to inject own HTML into a web page during web page generation. For example by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the `HtmlGenerator`. This XSS vulnerability exists because the values of these properties are neither filtered nor escaped, as can be seen here: - https://github.com/jgnieck


Mitigations:

Architectural layers (MAESTRO):