PT-2022-28217 · Unknown · Adhocore/Json-Comment+1

Published 2022-08-18 · Updated 2022-08-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP (affected versions not specified)

Description The issue arises from the pocketmineentitySkin component not handling errors correctly when parsing skin geometry data. Specifically, it expects false to be returned in case of an error, but instead, adhocore/json-comment throws a RuntimeException, leading to a server crash. This can occur if the skin geometry data is invalid, such as containing syntax errors.

Recommendations As a temporary workaround, consider developing a plugin to handle LoginPacket and PlayerSkinPacket to verify that the skin geometry data can be parsed correctly, thus preventing the error condition in the core code from being reached. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

GHSA-8CWQ-4CMF-PX73

Affected Products

Pocketmine-Mp

Adhocore/Json-Comment

References · 4

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8cwq-4cmf-px73 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/c9626c610b8f6810c8c987559c9197b2a291f0bb · Exploit
• https://osv.dev/vulnerability/GHSA-8cwq-4cmf-px73 · Vendor Advisory