Executive brief
TS3 Manager is a web interface for administering TeamSpeak 3 servers. The /api/download endpoint contains a reflected cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious script into responses sent to logged-in operators. When an operator clicks a crafted link, the attacker's script runs with the operator's privileges and can steal the authentication token (which lacks security attributes), then use it to retrieve the cleartext ServerQuery password and take over the managed TeamSpeak server.
Technical details
The vulnerability is a reflected XSS in the /api/download handler that fails to sanitize the attacker-controlled port query parameter before passing it to socket.connect(port, host) and reflecting error.message in an HTML response without Content Security Policy. The response lacks CSP headers, enabling script execution in the manager's origin. The authentication token cookie (set in packages/ui/src/store/modules/query.js) is stored without HttpOnly, Secure, or explicit SameSite attributes, making it accessible to JavaScript. A successful exploit requires a valid operator session and user interaction (clicking a malicious link). The attacker can then call the autofillform event to retrieve the decoded JWT containing the cleartext ServerQuery password, enabling full server hijacking. The vulnerability was fixed in version 2.2.6.
Affected products
- joni1802 TS3 Manager prior to 2.2.6
Timeline
- 2026-09-17: disclosed
- 2026-06-04: patched: Version 2.2.6 released