PT-2022-28267 · Unknown · Pocketmine-Mp

Published 2022-01-06 · Updated 2022-01-06

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 3.26.5 PocketMine-MP versions prior to 4.0.5

Description The issue allows players to fill book pages with an excessive number of characters, as the server does not enforce the character limit. Additionally, the maximum of 50 pages is not enforced, enabling players to create "book bombs". This causes several problems, including oversized NBT data, which results in excess bandwidth usage for both the server and client, server crashes when saving region-based worlds due to exceeding the maximum chunk size, and server crashes if any book page exceeds 32 KiB due to the TAG String size limit. An attacker must first obtain a writable book to exploit this issue.

Recommendations For versions prior to 3.26.5, update to version 3.26.5 or later. For versions prior to 4.0.5, update to version 4.0.5 or later. As a temporary workaround, consider banning writable books or using a plugin to cancel the PlayerEditBookEvent if strlen(text) > 1024 || mb strlen(text) > 256.

Exploit

Fix

Related Identifiers

GHSA-P62J-HRXM-XCXF

Affected Products

Pocketmine-Mp

References · 3

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-p62j-hrxm-xcxf · Exploit
• https://osv.dev/vulnerability/GHSA-p62j-hrxm-xcxf · Vendor Advisory