PT-2022-16311 · Mojang · Mojang Bedrock Dedicated Server

Published 2022-03-28 · Updated 2022-04-04 · CVE-2022-23884

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mojang Bedrock Dedicated Server version 1.18.2

Description The issue is caused by an integer overflow leading to a bound check bypass in the PurchaseReceiptPacket:: read function, which is a packet deserializer. This function is used to process incoming packets, and the integer overflow allows for a bypass of the normal bounds checking, potentially leading to unauthorized access or data manipulation.

Recommendations For Mojang Bedrock Dedicated Server version 1.18.2, consider disabling the PurchaseReceiptPacket:: read function until a patch is available to prevent potential exploitation. Restrict access to the packet deserializer to minimize the risk of exploitation. Avoid using the PurchaseReceiptPacket in the affected server version until the issue is resolved.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2022-23884

Affected Products

Mojang Bedrock Dedicated Server

References · 6

• 🔥 https://s3.bmp.ovh/imgs/2022/01/962e0c75f5969cfb.png · Exploit
• 🔥❌ https://github.com/LuckyDogDog/CVE-2022-23884 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-23884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23884 · Security Note
• https://t.me/cibsecurity/39641 · Telegram Post
• https://t.me/cvenotify/28422 · Telegram Post