PT-2023-25384 · Unknown · Fastasyncworldedit

Supermonis · Published 2023-06-22 · Updated 2023-07-03 · CVE-2023-35925

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FastAsyncWorldEdit versions prior to 2.6.3

Description This issue enables an attacker to select a region with the Infinity keyword and execute any operation, potentially bringing the server down. The attacker can exploit this by selecting a position with the Infinity keyword via commands like //pos2 Infinity and then executing further operations.

Recommendations For versions prior to 2.6.3, update FastAsyncWorldEdit to version 2.6.3 as soon as possible to address the vulnerability. As a temporary workaround, consider restricting the use of the Infinity keyword in position selection commands until the update is applied. Additionally, users with access to server logs can try to identify possible abuses of this issue by searching for the regex query //pos[12] Infinity in the logs.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-35925

GHSA-WHJ9-M24X-QHHP

Affected Products

Fastasyncworldedit

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35925.json · Exploit
• https://github.com/IntellectualSites/FastAsyncWorldEdit/security/advisories/GHSA-whj9-m24x-qhhp · Vendor Advisory
• https://github.com/IntellectualSites/FastAsyncWorldEdit/pull/2285 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-35925 · Security Note
• https://osv.dev/vulnerability/GHSA-whj9-m24x-qhhp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35925 · Vendor Advisory
• https://github.com/IntellectualSites/FastAsyncWorldEdit · Note
• https://github.com/IntellectualSites/FastAsyncWorldEdit/releases/tag/2.6.3 · Note
• https://t.me/cvenotify/53595 · Telegram Post