medium CVSS 6.1

CVE-2024-47765·PHP vulnerability

Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD. The HtmlGenerator iterates through objects of MotdItem that are contained in an object of MotdItemCollection to generate a HTML string. An attacker can make malicious inputs to the color and text properties of MotdItem to inject own HTML into a web page during web page generation. For example by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the HtmlGenerator. This XSS vulnerability exists because the values of these properties are neither filtered nor escaped. This vulnerability is fixed in 1.0.6.

Severity
medium
Software
PHP
Fixed in
1.0.6
Published
2024-10-04

Affected versions

Until: 1.0.6

Fixed in: 1.0.6

How to fix this CVE

If your PHP application uses the Minecraft MOTD Parser library, upgrade to version 1.0.6 or later immediately to remediate an XSS vulnerability in the HtmlGenerator class. The vulnerability allows attackers to inject malicious HTML through crafted MOTD strings from compromised Minecraft servers, potentially compromising users who view the generated pages. Update the library via Composer with `composer update jgniecki/minecraft-motd-parser` and verify the new version is deployed to production.

sudo dnf update php php-cli php-fpm && composer update jgniecki/minecraft-motd-parser

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET.*motd.*content.*type:\s*text/html|\x3cscript[^\x3e]*\x3e.*minecraft|\x3cimg[^\x3e]*on(load|error)\s*=|\x3c(iframe|object|embed)[^\x3e]*src\s*=

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement input validation at the WAF level to reject Minecraft MOTD query responses containing script tags, event handlers (onclick, onload, onerror), or HTML entities in the color or text parameters. Block requests where the MOTD response contains unescaped angle brackets in user-controlled fields before they reach the HtmlGenerator class.

How to check if you are affected

  1. Check the installed version of Minecraft MOTD Parser with: composer show jgniecki/minecraft-motd-parser | grep Version
  2. Identify if your application directly uses HtmlGenerator by searching codebase: grep -r 'HtmlGenerator' /path/to/app/vendor/jgniecki/
  3. Review web server access logs for requests containing Minecraft server queries or MOTD-related endpoints: tail -f /var/log/apache2/access.log | grep -i motd
  4. Verify the fix by confirming version >= 1.0.6 is installed: composer show jgniecki/minecraft-motd-parser | grep -E 'v1\.0\.[6-9]|v1\.[1-9]|v[2-9]'

FAQ

What is CVE-2024-47765?

CVE-2024-47765 is a cross-site scripting (XSS) vulnerability in the Minecraft MOTD Parser PHP library that allows attackers to inject malicious HTML through unfiltered color and text properties when parsing Minecraft server MOTD strings. The vulnerability exists in the HtmlGenerator class, which fails to escape or sanitize user-controlled input before rendering it as HTML.

Is CVE-2024-47765 being actively exploited?

No, CVE-2024-47765 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploit code is available. However, the vulnerability remains exploitable if the library is used in production environments.

What versions of the Minecraft MOTD Parser are affected by CVE-2024-47765?

All versions prior to 1.0.6 are vulnerable. The vulnerability has been patched in version 1.0.6 and later releases.

How do I check if my server is vulnerable to CVE-2024-47765?

Run `composer show jgniecki/minecraft-motd-parser` to retrieve the installed version. If the version is below 1.0.6 or the package is not found, your application is either unaffected or already patched. For manual verification, check your composer.lock file for the installed version of jgniecki/minecraft-motd-parser.

Does Defensia detect CVE-2024-47765?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Minecraft MOTD Parser library is present in your PHP project's composer.lock file, CVE-2024-47765 will appear in your dashboard with remediation steps and version guidance.

Related PHP CVEs

CVE-2025-47916CVSS 10Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-47765. Free for 1 server.

Get started free