Description

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-17T19:16:50.203Z",
  "pubdate": "2026-09-17T19:16:50.203Z",
  "executiveSummary": "TS3 Manager versions prior to 2.2.6 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability via the /api/download endpoint.\nThe vulnerability arises from the improper handling of the 'port' query parameter, which is passed to the socket.connect() function and subsequently reflected in the HTTP response body without adequate sanitization or Content Security Policy (CSP) protections.\nAn authenticated operator session is required, along with victim interaction (e.g., following a malicious link).\nSuccessful exploitation allows an attacker to execute arbitrary JavaScript within the context of the manager's origin.\nDue to the lack of HttpOnly, Secure, and SameSite attributes on the authentication token cookie, the attacker can extract the session token and access the 'autofillform' event handler.\nThis grants the attacker access to the decrypted JWT, including the cleartext TeamSpeak ServerQuery password, leading to full session hijacking and unauthorized control over the managed TeamSpeak server infrastructure.\nThe vulnerability poses a severe risk to service integrity and administrative account security.",
  "technicalDetails": "The root cause is a cross-site scripting (XSS) vulnerability located in the /api/download handler within packages/server/routes/api.js. The application accepts a user-controlled 'port' query parameter and passes it directly into the socket.connect(port, host) method. When this connection attempt fails, the error message returned by the underlying socket library is propagated to the client via res.status(400).send(error.message).\nBecause the output is returned as text/html without any restrictive Content Security Policy (CSP), an attacker can craft a URL containing malicious script tags within the 'port' parameter. When an authenticated operator clicks this link, the reflected JavaScript executes within the security context of the TS3 Manager origin.\nThe exploitation process is facilitated by insufficient cookie security configurations in packages/ui/src/store/modules/query.js. The session token cookie is configured without the 'HttpOnly' flag, allowing it to be accessed via document.cookie, and lacks 'Secure' or 'SameSite' attributes, exposing it to potential interception or improper cross-site usage.\nOnce the attacker executes arbitrary JavaScript, they can extract the victim's session token and interact with the 'autofillform' event exposed in packages/server/socket.js. Invoking this event causes the server to return the decoded JWT containing the cleartext ServerQuery credentials used to manage the TeamSpeak server.\nThe attack flow proceeds as follows: 1) The attacker identifies a target operator with an active session. 2) The attacker crafts a malicious URI incorporating a script payload in the 'port' parameter. 3) The operator is lured into accessing this URI. 4) The server reflects the malicious payload, which executes in the operator's browser. 5) The script reads the non-HttpOnly token and invokes the 'autofillform' event. 6) The resulting cleartext ServerQuery credentials are exfiltrated to an attacker-controlled server. 7) The attacker utilizes these credentials to assume full control over the managed TeamSpeak server, bypassing application-level access controls."
}