CVE-2025-5990: Crafty Controller Stored XSS Vulnerability

CVE-2025-5990 Overview

CVE-2025-5990 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Crafty Controller, a web-based Minecraft server management platform. The flaw affects the Server Name form and API Key form components, which fail to properly neutralize user-supplied input before storing and rendering it in the application interface. An authenticated remote attacker can inject malicious script payloads through these forms. When another user views the affected page, the stored script executes in that user's browser session under the Crafty Controller origin.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads that execute in the browser context of other Crafty Controller users, enabling session theft, credential harvesting, and unauthorized actions performed on behalf of the victim.

Affected Products

Crafty Controller 4.2.0
Crafty Controller prior versions within the affected 4.x branch
Deployments using the web management interface for Minecraft server administration

Discovery Timeline

2025-06-15 - CVE-2025-5990 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5990

Vulnerability Analysis

The vulnerability resides in two form-handling components of Crafty Controller: the Server Name input field and the API Key form. Both components accept user-controlled string input and persist that input to backend storage. When the stored values are later rendered in the web interface, the application returns the raw content without applying HTML entity encoding or context-aware output escaping. This allows arbitrary HTML and JavaScript to execute in the browser of any user who views a page containing the injected content. Because the payload is stored server-side, exploitation does not require crafting a per-victim link or convincing users to click an external URL.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Crafty Controller trusts input submitted through authenticated forms and reflects that data into HTML contexts without sanitization. Effective mitigation requires context-sensitive output encoding at the template layer rather than filtering on input alone.

Attack Vector

Exploitation requires an authenticated session with permission to modify server names or generate API keys. The attacker submits a form containing a script payload, which is persisted to the database. Any authenticated user with access to the affected view — including administrators — triggers execution when loading the page. The scope change indicates that impact extends beyond the vulnerable component to affect the victim's browser session and any resources accessible from it.

Refer to the GitLab Issue Discussion for technical details published by the project maintainers.

Detection Methods for CVE-2025-5990

Indicators of Compromise

Server names or API key labels containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the Crafty Controller database
Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled domains after accessing the management console
Anomalous session token usage originating from IP addresses that differ from the legitimate administrator's location

Detection Strategies

Audit stored Server Name and API Key values for characters and sequences associated with HTML or JavaScript injection
Deploy Content Security Policy (CSP) reporting endpoints to capture script execution violations within the Crafty Controller origin
Review web server access logs for POST requests to server configuration and API key management endpoints containing encoded script fragments

Monitoring Recommendations

Monitor Crafty Controller authentication logs for privilege changes or unusual API key creation activity
Correlate browser-side script execution events with recent form submissions to identify injection attempts
Track outbound network connections from workstations used to administer Crafty Controller instances

How to Mitigate CVE-2025-5990

Immediate Actions Required

Upgrade Crafty Controller to a fixed release published after June 15, 2025, that addresses issue 567 in the upstream repository
Review all existing Server Name and API Key entries and remove any values containing HTML or script content
Rotate API keys and administrator session tokens if any injected content is discovered

Patch Information

Refer to the GitLab Issue Discussion for the official remediation status and fixed version information. Apply the vendor-provided update as soon as it becomes available in your deployment channel.

Workarounds

Restrict access to server configuration and API key management functions to a minimal set of trusted administrators
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to the Crafty Controller origin
Place the Crafty Controller interface behind a web application firewall configured to filter HTML and JavaScript payloads in form submissions

bash

# Example CSP header to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";