NamelessMC Cross-Site Scripting Vulnerability in SEO Component

A cross-site scripting (XSS) vulnerability has been identified in NamelessMC versions prior to 2.2.4. This vulnerability allows remote authenticated attackers to inject arbitrary web scripts or HTML. The issue arises in the SEO component, where the default_keywords parameter can be manipulated to execute injected scripts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a POST request to the '/nameless/panel/core/seo/' endpoint. Include the default_keywords parameter with a crafted value that injects a script, such as an alert() call. This request must be sent from an account with permission to access the SEO section.

Remediation

Users can upgrade to NamelessMC version 2.2.4 or later to address this vulnerability.