CVE-2025-30158: NamelessMC UI-Based DoS Vulnerability

CVE-2025-30158 Overview

CVE-2025-30158 affects NamelessMC, a free website software widely deployed by Minecraft server operators. The forum component in version 2.1.4 and earlier accepts iframe HTML elements in topics, comments, and feed posts without validating the width and height attributes. An authenticated attacker can post an oversized iframe that covers the forum interface and blocks legitimate user interaction. The issue is categorized as uncontrolled resource consumption [CWE-400] and results in a user-interface denial of service (DoS). NamelessMC addressed the flaw in version 2.2.0 by adding a HTML Purifier rule that forbids the width and height attributes on iframe elements.

Critical Impact
Any authenticated forum user can render the NamelessMC UI unusable by embedding an oversized iframe in a post, disrupting community operations until moderators remove the content.

Affected Products

NamelessMC Nameless 2.1.4 and prior versions
Forum module (topics, comments, and activity feed)
Installations running the default HTML Purifier configuration

Discovery Timeline

2025-04-18 - CVE-2025-30158 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30158

Vulnerability Analysis

NamelessMC uses the HTML Purifier library to sanitize user-supplied content in the forum. The sanitization policy in core/classes/Core/Output.php explicitly permits iframe elements through the HTML.SafeIframe directive and lists height and width in HTML.AllowedAttributes. The policy does not cap the numeric values of those attributes. An authenticated user can therefore embed an iframe sized to millions of pixels, which forces the browser to allocate a viewport that overlays adjacent forum controls. Because the malicious content persists in the database, every visitor loading the affected topic experiences the same UI blockage, extending the impact beyond the attacker's session.

Root Cause

The root cause is missing input validation on iframe dimension attributes in the output sanitization pipeline. HTML Purifier accepts any integer value for width and height unless the host application forbids them. NamelessMC did not restrict these attributes, so oversized dimensions passed through unchanged.

Attack Vector

An attacker requires a valid forum account and permission to post content. The attacker submits a topic, reply, or feed entry containing an <iframe> element with extreme dimension values. Once stored, the payload renders for every subsequent viewer of that thread, producing a persistent client-side DoS.

php

// Patch: core/classes/Core/Output.php
// Source: https://github.com/NamelessMC/Nameless/commit/caa42a975338a13fbc1658e8c440108f16135643
$purifierConfig->set('CSS.AllowedProperties', ['text-align', 'display', 'float', 'color', 'background-color', 'background', 'font-size', 'font-family', 'margin', 'margin-bottom', 'margin-left', 'margin-right', 'margin-top', 'padding', 'padding-bottom', 'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'font-weight', 'font-style', 'font-size', 'vertical-align']);
$purifierConfig->set('CSS.AllowTricky', true);
$purifierConfig->set('HTML.AllowedAttributes', 'target, rel, href, id, src, height, width, alt, class, *.style, dir');
$purifierConfig->set('HTML.ForbiddenAttributes', 'iframe@width,iframe@height');
$purifierConfig->set('Attr.AllowedFrameTargets', ['_blank', '_self', '_parent', '_top']);
$purifierConfig->set('Attr.AllowedRel', ['noopener', 'nofollow']);
$purifierConfig->set('HTML.SafeIframe', true);

The added HTML.ForbiddenAttributes directive blocks the width and height attributes on iframe elements while preserving safe iframe embedding.

Detection Methods for CVE-2025-30158

Indicators of Compromise

Forum posts, comments, or feed entries containing <iframe> tags with width or height values that exceed typical viewport dimensions.
Database rows in the posts or comments tables where sanitized HTML retains numeric iframe sizing attributes.
User reports of forum pages rendering blank, frozen, or with controls pushed off-screen after a specific post loads.

Detection Strategies

Query the NamelessMC database for stored content matching a regular expression such as iframe[^>]*(width|height)\s*=\s*["']?\d{4,} to surface oversized embeds.
Review moderator and administrator audit logs for posts flagged or reported around the time UI issues began.
Instrument the HTTP layer to log requests returning HTML responses larger than expected for forum endpoints.

Monitoring Recommendations

Track NamelessMC version telemetry across managed deployments and flag any host still running 2.1.4 or earlier.
Monitor forum activity feeds for anomalous posting patterns from newly registered accounts, which are the typical vector for authenticated abuse.
Alert on client-side error reports or user-submitted tickets referencing broken forum rendering.

How to Mitigate CVE-2025-30158

Immediate Actions Required

Upgrade NamelessMC to version 2.2.0 or later, which enforces the HTML.ForbiddenAttributes restriction on iframe dimensions.
Audit existing forum content for stored iframes and delete or edit posts containing oversized dimension attributes.
Restrict posting permissions to trusted user groups until the upgrade is verified in production.

Patch Information

The fix is applied in commit caa42a975338a13fbc1658e8c440108f16135643 and ships in the GitHub Release v2.2.0. Additional context is documented in the GitHub Security Advisory GHSA-2prx-rgr7-hq5f. The patch adds a single HTML Purifier directive that forbids the iframe@width and iframe@height attributes during output sanitization.

Workarounds

Manually edit core/classes/Core/Output.php to add $purifierConfig->set('HTML.ForbiddenAttributes', 'iframe@width,iframe@height'); if upgrading immediately is not feasible.
Disable iframe support entirely by setting HTML.SafeIframe to false in the HTML Purifier configuration, accepting the loss of legitimate iframe embeds.
Temporarily remove forum posting privileges from untrusted user roles to reduce the attack surface.

bash

# Verify the running NamelessMC version and pull the fixed release
git -C /var/www/nameless describe --tags
git -C /var/www/nameless fetch --tags
git -C /var/www/nameless checkout v2.2.0
# Confirm the patched directive is present
grep -n "ForbiddenAttributes" /var/www/nameless/core/classes/Core/Output.php