PT-2023-33069 · Unknown · Pocketmine-Mp

Published 2023-01-09 · Updated 2023-01-09

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP (affected versions not specified)

Description The issue arises from the DyeColorIdMap->fromId() function not handling invalid input properly, leading to an undefined offset error. This function is indirectly called during the deserialization of item NBT data, which can occur when receiving data from the network or disk. An attacker can exploit this by providing NBT data with invalid pattern color values in an inventory transaction or by using the /give command to obtain an item with malicious NBT data, potentially crashing a server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

GHSA-WQQV-JCFR-9F5G

Affected Products

Pocketmine-Mp

References · 5

• 🔥 https://github.com/pmmp/PocketMine-MP · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/blob/38d6284671e8b657ba557e765a6c29b24a7705f5/src/item/Banner.php#L104 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g · Exploit
• https://osv.dev/vulnerability/GHSA-wqqv-jcfr-9f5g · Vendor Advisory