PT-2023-32994 · Unknown · Pocketmine

Publicado 2023-07-14 · Atualizado 2023-07-14

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine versions prior to 4.22.3 PocketMine versions prior to 5.2.1

Description A player can cause the server to crash by sending a packet with incorrect sign data in NBT in the BlockActorDataPacket. This can be achieved by sending an NBT with an incorrect type, which would throw an error. The issue was discovered in version 4.22.1, and it is possible that other packets may also be affected. This makes it possible to shut down a server for someone who knows how to operate it.

Recommendations For PocketMine versions prior to 4.22.3, update to version 4.22.3 or later to resolve the issue. For PocketMine versions prior to 5.2.1, update to version 5.2.1 or later to resolve the issue. As a temporary workaround, consider using a plugin to handle DataPacketReceiveEvent for BlockActorDataPacket and verify that the FrontText tag is a TAG Compound to prevent the server from crashing.

Exploit

Correção

Identificadores relacionados

GHSA-7WRV-6H42-W54F

Produtos afetados

Pocketmine

Referências · 4

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea · Exploit
• https://osv.dev/vulnerability/GHSA-7wrv-6h42-w54f · Aviso do Fabricante