PT-2021-22435 · Geyser · Geyser

Camotoy + 3 · Published 2021-08-30 · Updated 2021-09-10 · CVE-2021-39177

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Geyser versions prior to 1.4.2-SNAPSHOT

Description The issue allows anyone that can connect to the server to forge a LoginPacket with a manipulated JWT token, enabling impersonation as any user. This affects users who have saved their credentials in the configuration. However, online mode is not affected if credentials are not saved, as users are still required to log in separately. The estimated number of potentially affected devices is not provided.

Recommendations To resolve the issue, upgrade to Geyser version 1.4.2-SNAPSHOT or later. As a temporary workaround, consider using online mode and avoid saving credentials in the Geyser configuration. Additionally, using an extra authentication method on the Java server can help minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-39177

GHSA-H77F-XXX7-4858

Affected Products

Geyser

References · 8

• https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 · Patch
• https://github.com/GeyserMC/Geyser/security/advisories/GHSA-h77f-xxx7-4858 · Patch
• https://osv.dev/vulnerability/GHSA-h77f-xxx7-4858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39177 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39177 · Vendor Advisory
• https://github.com/GeyserMC/Geyser · Note
• https://t.me/cvenotify/20408 · Telegram Post
• https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY · Note