CVE-2025-22142
📋 TL;DR
This is a stored cross-site scripting (XSS) vulnerability in NamelessMC where administrators can add custom user profile fields that accept JavaScript input. When staff members view affected user profiles in the admin panel, malicious JavaScript executes in their browsers. This affects all NamelessMC installations running versions before 2.1.3.
💻 Affected Systems
- NamelessMC
📦 What is this software?
Nameless by Namelessmc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal staff session cookies, perform actions as staff members, redirect to malicious sites, or install malware on staff computers.
Likely Case
Attackers steal staff session tokens to gain administrative access, modify site settings, or access sensitive user data.
If Mitigated
With proper input validation and output encoding, the JavaScript would be rendered harmless as text rather than executed code.
🎯 Exploit Status
Exploitation requires an admin to first create a vulnerable custom field, then any user can inject JavaScript into that field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.3
Vendor Advisory: https://github.com/NamelessMC/Nameless/security/advisories/GHSA-9q22-w64p-g8qm
Restart Required: No
Instructions:
1. Backup your NamelessMC installation and database. 2. Download version 2.1.3 from the official GitHub releases. 3. Replace all files with the new version. 4. Clear any caching mechanisms. 5. Verify the update completed successfully.
🧯 If You Can't Patch
- Disable all custom user profile fields in the admin panel.
- Implement strict Content Security Policy (CSP) headers to block inline JavaScript execution.
🔍 How to Verify
Check if Vulnerable:
Check if your NamelessMC version is below 2.1.3 in the admin panel or by examining the core/version.php file.Check Version:
grep -i 'version' core/version.phpVerify Fix Applied:
After updating, verify the version shows 2.1.3 or higher in the admin panel or core/version.php file.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript content in user profile fields
- Multiple staff accounts accessing the same user profile in quick succession
Network Indicators:
- Outbound connections to suspicious domains from staff IPs after viewing user profiles
SIEM Query:
source="namelessmc_logs" AND (message="*javascript:*" OR message="*<script>*")