PT-2022-28242 · Unknown · Pocketmine-Mp

Published 2022-06-07 · Updated 2022-06-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to the version containing the patch 5fd685e07d61ef670584ed11a52fd5f4b99a81a7

Description The issue arises from a workaround implemented for unmapped network items, allowing arbitrary item IDs to be written into an item's NBT. This leads to an exploit due to internal limits on the range that item IDs can occupy, causing an uncaught exception that crashes the server. The TAG Int type used to represent replacement IDs for unknown items has a larger range, from -(2^31) to 2^31 - 1, than the internal limits of -32768 to 32767.

Recommendations For versions prior to the patch 5fd685e07d61ef670584ed11a52fd5f4b99a81a7, update to a version that includes this patch to resolve the issue. As a temporary workaround, consider using a custom TypeConverter in plugins to check for the exploit, although this may be cumbersome.

Exploit

Fix

Related Identifiers

GHSA-FQX3-R75H-VC89

Affected Products

Pocketmine-Mp

References · 5

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/8ac16345a3bc099b62c1f5cfbf3b736e621c3f76 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89 · Exploit
• https://osv.dev/vulnerability/GHSA-fqx3-r75h-vc89 · Vendor Advisory