CVE-2025-65229
📋 TL;DR
A stored XSS vulnerability in Lyrion Music Server allows authenticated users to inject malicious scripts into the Player name field. These scripts execute when other users view the Player Info tab, potentially compromising their sessions or stealing credentials. This affects all users of Lyrion Music Server versions 9.0.3 and earlier.
💻 Affected Systems
- Lyrion Music Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal admin credentials, hijack sessions, redirect users to malicious sites, or perform actions on behalf of authenticated users.
Likely Case
Session hijacking, credential theft, or defacement of the player information page.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though stored XSS remains a persistent threat.
🎯 Exploit Status
Exploitation requires authenticated access; stored XSS is straightforward to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://lyrion.org/
Restart Required: No
Instructions:
Check vendor website for updates; no official patch details available yet.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to sanitize HTML/JavaScript in the Player name field.
Output Encoding
allApply proper output encoding (e.g., HTML entity encoding) when rendering the Player name on the Player Info tab.
🧯 If You Can't Patch
- Restrict access to Settings Player to trusted users only.
- Monitor and audit changes to Player name fields for suspicious content.
🔍 How to Verify
Check if Vulnerable:
Attempt to inject a simple script (e.g., <script>alert('XSS')</script>) into the Player name field and check if it executes on the Player Info tab.Check Version:
Check the server version in the web interface or configuration files; refer to vendor documentation.Verify Fix Applied:
Verify that injected scripts are properly sanitized or encoded and do not execute when viewing the Player Info tab.📡 Detection & Monitoring
Log Indicators:
- Unusual or lengthy entries in Player name update logs
- Script tags or JavaScript code in Player name fields
Network Indicators:
- Unexpected outbound connections from the server after viewing Player Info tab
SIEM Query:
Search for events where Player name field contains script tags or JavaScript patterns (e.g., <script>, alert(), document.cookie).