GHSA-8cwq-4cmf-px73 CVE-2022-51009
PocketMine-MP invalid skin geometry JSON data leading to server crash
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.61%
- Chance of exploitation in the next 30 days. Higher than 49.18% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
4.7.2- Upgrade pocketmine/pocketmine-mp to this version or later
Description
Impact
pocketmine\entity\Skin doesn't correctly handle errors produced by adhocore/json-comment, which throws RuntimeException rather than returning false as PocketMine-MP expects.
This leads to a server crash if the skin geometry data is invalid for some reason (e.g. a syntax error).
Patches
c9626c610b8f6810c8c987559c9197b2a291f0bb
Workarounds
A plugin could handle LoginPacket and PlayerSkinPacket to verify the skin geometry data can be parsed correctly, so that the error condition in the core code is never reached.
For more information
If you have any questions or comments about this advisory:
- Email us at security@pmmp.io
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pocketmine/pocketmine-mp | < 4.7.2 |
4.7.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pocketmine/pocketmine-mp Packagist → 4.7.2
- composer
composer require pocketmine/pocketmine-mp:^4.7.2
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pg53-p7qp-65cv PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets | Low | Also affects pocketmine/pocketmine-mp |
| GHSA-xp4f-g2cm-rhg7 PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-7hmv-4j2j-pp6f PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-788v-5pfp-93ff PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-h6rj-3m53-887h PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket | High | Also affects pocketmine/pocketmine-mp |
| GHSA-fqqv-56h5-f57g PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-g274-c6jj-h78p PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | Medium | Also affects pocketmine/pocketmine-mp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor