PT-2023-33049 · Unknown · Pocketmine-Mp+1

Published 2023-06-06 · Updated 2023-06-06

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.20.5 PocketMine-MP versions prior to 4.21.1

Description An attacker could crash PocketMine-MP by sending malformed JSON in the LoginPacket. This issue occurred due to a bug in the netresearch/jsonmapper library, which failed to perform proper checks when mapping JSON arrays and objects onto scalar model properties such as strings.

Recommendations For PocketMine-MP versions prior to 4.20.5, update to version 4.20.5 or later to resolve the issue. For PocketMine-MP versions prior to 4.21.1, update to version 4.21.1 or later to resolve the issue. As a temporary workaround, users of PocketMine-MP source installations may manually install the patched version of JsonMapper by backporting commit pmmp/PocketMine-MP@09668a37d66c6023685a948b7550c918620e98f2. A plugin may also be able to workaround this issue by using DataPacketReceiveEvent to attempt detection of suspicious payloads and catching the ErrorException that is thrown in the crash case.

Exploit

Fix

Related Identifiers

GHSA-PQP3-8RRW-G8VM

Affected Products

Pocketmine-Mp

Netresearch/Jsonmapper

References · 6

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pqp3-8rrw-g8vm · Exploit
• https://osv.dev/vulnerability/GHSA-pqp3-8rrw-g8vm · Vendor Advisory
• https://github.com/cweiske/jsonmapper/pull/210 · Note
• https://github.com/pmmp/netresearch-jsonmapper/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012 · Note