Skip to content
Log inStart free trial

GHSA-j5qg-w9jg-3wg3 CVE-2021-48006

Inability to de-op players if listed in ops.txt with non-lowercase letters

Medium Packagist
Severity
4.8 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.15%
Chance of exploitation in the next 30 days. Higher than 4.63% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-178 Improper Handling of Case Sensitivity
Fix
4.0.3
Upgrade pocketmine/pocketmine-mp to this version or later

Description

Impact

Originally reported in iTXTech/Genisys#1188

PotterHarry98
potterharry98

deop PotterHarry98

will remove potterharry98 from the ops.txt but not PotterHarry98.

Operator permissions are checked using Config->exists() with lowercase=true, which will result in a match: https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449

This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.

Patches

4d37b79ff7f9d9452e988387f97919a9a1c4954e

Workarounds

This can be easily addressed by removing the offending lines from ops.txt manually.

For more information

If you have any questions or comments about this advisory:

Affected versions

Packagist

PackageVulnerableFixed in
pocketmine/pocketmine-mp
< 4.0.3
4.0.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

pocketmine/pocketmine-mp Packagist → 4.0.3

composer
composer require pocketmine/pocketmine-mp:^4.0.3

Severity breakdown

CVSS 4.0 4.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Local
Attack complexity
Low
Attack requirements
None
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
None
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Not defined
Scope
X

CVSS 3.1 3.3

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Weakness

CWE-178: Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

How to prevent it
  • Architecture and Design: Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
  • Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

References

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-pg53-p7qp-65cv
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Low Also affects pocketmine/pocketmine-mp
GHSA-xp4f-g2cm-rhg7
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
Medium Also affects pocketmine/pocketmine-mp
GHSA-f9jp-856v-8642
PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state
Medium Also affects pocketmine/pocketmine-mp
GHSA-7hmv-4j2j-pp6f
PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`
Medium Also affects pocketmine/pocketmine-mp
GHSA-788v-5pfp-93ff
PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling
Medium Also affects pocketmine/pocketmine-mp
GHSA-h6rj-3m53-887h
PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket
High Also affects pocketmine/pocketmine-mp
GHSA-fqqv-56h5-f57g
PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking
Medium Also affects pocketmine/pocketmine-mp
GHSA-g274-c6jj-h78p
PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()
Medium Also affects pocketmine/pocketmine-mp
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor