Description

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T09:16:30.827Z",
  "pubdate": "2026-09-13T09:16:30.827Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Stats Generation component of stilleshan ServerStatus versions 1.0 and 2.0.\nThe vulnerability originates from the improper sanitization of the 'custom' argument within server/src/main.cpp, allowing for the injection and execution of malicious client-side scripts.\nThe flaw is remotely exploitable, requiring no authentication, and poses a significant risk to user sessions and data integrity.\nAn attacker can leverage this vulnerability to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to unauthorized actions, session hijacking, or sensitive data exfiltration.\nThe vendor was notified of this vulnerability but failed to provide a response or corrective patch, leaving deployments exposed to public exploits.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw located in the Stats Generation component of the ServerStatus application.\nSpecifically, the issue resides within the file server/src/main.cpp, where the input provided via the 'custom' argument is processed by the server-side logic and subsequently rendered in the response without adequate input validation or context-aware output encoding.\nThe attack flow begins when an attacker crafts a malicious URI containing a payload designed to break out of the intended HTML context—typically by injecting script tags or event handlers (e.g., onload, onerror).\nBecause the 'custom' argument is unsafely reflected into the rendered page, the attacker's payload is interpreted and executed by the victim's browser upon visiting the crafted link.\nThis vulnerability is remotely accessible over the network and does not require the attacker to possess prior authentication or elevated privileges within the application.\nThe root cause is a failure to implement output encoding or strict input filtering for user-supplied data that is reflected back to the client.\nOnce the injected script executes in the victim's browser, the attacker can perform a variety of malicious actions. These include, but are not limited to, accessing session tokens stored in cookies or localStorage, performing actions on behalf of the authenticated user, redirecting the user to malicious sites, or defacing the interface.\nGiven that the exploit is public, the risk of exploitation by automated scanners and malicious actors is high, especially in environments where ServerStatus is deployed in exposed network segments without proper perimeter defenses or Content Security Policy (CSP) headers."
}