Listen to this Post
The vulnerability is a stored cross-site scripting (XSS) flaw in the web interface of Lyrion Music Server versions 9.0.3 and earlier. It originates from improper neutralization of user input, classified as CWE-79. An authenticated attacker with access to the ‘Settings Player’ section can inject arbitrary HTML or JavaScript code into the ‘Player name’ field. The server saves this malicious input to its database without adequate validation or sanitization. The stored payload is later retrieved and rendered unsafely on the ‘Information (Player Info)’ tab. Critical output encoding is missing when the player name is displayed on this page. Consequently, the injected script executes automatically in the browser of any user who views the Player Info tab. This attack occurs without requiring further interaction from the victim. Exploitation allows the attacker to perform actions within the security context of the victim user. This can lead to session hijacking, theft of credentials, or unauthorized changes to server settings. The attack vector is network-based, requires low attack complexity, and low privileges. User interaction is required for the impact but not for the initial exploitation. The confidentiality and integrity impacts are rated as low, with no direct effect on system availability.
Platform: Lyrion Music Server
Version: <= 9.0.3
Vulnerability : Stored XSS
Severity: Medium
date: 2025-12-08
Prediction: 2025-12-22
What Undercode Say:
Check server version curl -s http://<server-host>/api/version | grep -o 'version.' Test for basic XSS payload in Player name field (requires auth) curl -X POST 'http://<server-host>/settings/player' -H 'Cookie: <session_cookie>' --data 'player_name=<script>alert(1)</script>' Query the Player Info endpoint to see rendered output curl http://<server-host>/info/player
<!-- Example of a simple XSS payload for the Player name field -->
<img src=x onerror="alert('XSS')">
How Exploit:
- Attacker logs into the Lyrion Music Server web interface.
2. Attacker navigates to the Settings Player section.
- Attacker inputs a malicious script (e.g.,
<script>alert(document.cookie)</script>) into the Player name field and saves it.
4. The server stores this malicious payload.
- When any other user visits the Information (Player Info) tab, the stored script is rendered and executed in their browser.
Protection from this CVE:
1. Apply vendor patch when released.
2. Implement strict input validation.
3. Enforce proper output encoding.
4. Deploy Content Security Policy (CSP).
5. Restrict access to settings.
Impact:
Session hijacking possible.
Credential theft risk.
Unauthorized action execution.
Low confidentiality impact.
Low integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
