PT-2022-28243 · Packagist · Pocketmine/Pocketmine-Mp

Published 2022-04-22 · Updated 2022-04-22

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue arises when the client sends a serialized version of the itemstack to the server during an inventory interaction. The server then deserializes this data and compares it against its own copy. If the data does not match, the transaction is considered invalid. This process involves deserializing item NBT from the client, allowing for potentially bogus data to be provided. While usually harmless, certain types of bad data (e.g., incorrect ListTag type for the CanDestroy tag) could result in server crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1287

CWE-20

Related Identifiers

GHSA-G5RR-P69H-7V3G

Affected Products

Pocketmine/Pocketmine-Mp

References · 6

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/blob/4.2.9/changelogs/4.2.md#429 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/releases/tag/4.2.9 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g · Exploit
• https://osv.dev/vulnerability/GHSA-g5rr-p69h-7v3g · Vendor Advisory