GHSA-92jh-gwch-jq38 CVE-2023-54390
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.61%
- Chance of exploitation in the next 30 days. Higher than 49.19% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1025 Comparison Using Wrong Factors
- Fix
5.3.1- Upgrade pocketmine/pocketmine-mp to this version or later
Description
Impact
An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.
This happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect.
Code processing arrays in the JSON data could then crash due to unexpected NULL elements.
Patches
This problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8dab1c9df331fad7d3d89823404e882668c
An upstream patch for this issue was proposed via https://github.com/cweiske/jsonmapper/pull/211; however, as of 2024-05-15, the patch has not been accepted upstream due to debate about how to deal with the behavior. For now, a fork of JsonMapper is used by PocketMine-MP to workaround the issue.
Workarounds
A plugin may handle DataPacketReceiveEvent for LoginPacket and check that none of the input arrays contain NULL where it's not expected, but this is rather cumbersome.
References
Proposed upstream patch for a behavior change: https://github.com/cweiske/jsonmapper/pull/211
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pocketmine/pocketmine-mp | >= 5.0.0, < 5.3.1 |
5.3.1 |
| pocketmine/pocketmine-mp | < 4.23.1 |
4.23.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pocketmine/pocketmine-mp Packagist → 5.3.1
- composer
composer require pocketmine/pocketmine-mp:^5.3.1
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1025: Comparison Using Wrong Factors
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
References
Packages
Other links
- github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
- github.com/pmmp/netresearch-jsonmapper/commit/4f90e8dab1c9df331fad7d3d89823404e…
- github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
- vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pg53-p7qp-65cv PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets | Low | Also affects pocketmine/pocketmine-mp |
| GHSA-xp4f-g2cm-rhg7 PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-7hmv-4j2j-pp6f PocketMine-MP: Network amplification vulnerability with `ActorEventPacket` | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-788v-5pfp-93ff PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-h6rj-3m53-887h PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket | High | Also affects pocketmine/pocketmine-mp |
| GHSA-fqqv-56h5-f57g PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-g274-c6jj-h78p PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | Medium | Also affects pocketmine/pocketmine-mp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor