PT-2022-28232 · Unknown · Pocketmine-Mp

Published 2022-01-06 · Updated 2022-01-06

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP (affected versions not specified)

Description The issue arises from uncapped skin data fields, such as skinID and geometryName, which are saved in the NBT data of a player. These fields have a 32767 byte limit due to the TAG String limit. If any of these fields exceed this limit, an exception is thrown during data saving, causing the server to crash. Other fields like skinGeometryData have a larger limit and are not a concern due to the decompressed packet size limit.

Recommendations For affected versions, consider using a plugin to check player skins during the PlayerLoginEvent and PlayerSkinChangeEvent to ensure that the offending fields are not larger than 32767 bytes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

GHSA-C6FG-99PR-25M9

Affected Products

Pocketmine-Mp

References · 5

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/6492cac5c10f9fa8443ceddd2191a7b65b73f601 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-c6fg-99pr-25m9 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb · Exploit
• https://osv.dev/vulnerability/GHSA-c6fg-99pr-25m9 · Vendor Advisory