PT-2022-28291 · Unknown · Pocketmine-Mp

Published 2022-01-13 · Updated 2022-01-13

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP (affected versions not specified)

Description A remote attacker may crash a server by sending a PlayerActionPacket with invalid facing values, such as negative values, specifically with START BREAK or CRACK BLOCK actions, or with a UseItemTransactionData typically in InventoryTransactionPacket.

Recommendations For all affected versions, consider using a plugin to cancel the DataPacketReceiveEvent if the packet is a PlayerActionPacket and the facing is outside the range 0-5 when receiving START BREAK or CRACK BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

GHSA-XH99-HW7H-WF63

Affected Products

Pocketmine-Mp

References · 4

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63 · Exploit
• https://osv.dev/vulnerability/GHSA-xh99-hw7h-wf63 · Vendor Advisory