Executive brief
PocketMine-MP is a Minecraft server software platform. An administrator who attempts to remove operator (admin) privileges from a player using the deop command cannot do so if that player's name was originally added to the ops.txt file with uppercase letters. This leaves the player with admin access until the entry is manually removed from the configuration file.
Technical details
The vulnerability is a case-sensitivity logic error in the removeOp function. The function lowercases the supplied player name before attempting removal, but the ops.txt file is checked for an exact string match using Config->exists() with lowercase=true. This mismatch means that if an operator entry is stored with non-lowercase letters (e.g., "PotterHarry98"), the removeOp command will fail to find and delete it even when called with the lowercased variant. An attacker with local or administrative access to the server can exploit this by ensuring their name is added to ops.txt with mixed-case letters, making themselves impossible to de-op via normal commands. The vulnerability was patched in version 4.0.3 (commit 4d37b79) by implementing case-insensitive matching in the removal function.
Affected products
- PocketMine PocketMine-MP before 4.0.3
Timeline
- 2021-12-16: disclosed
- 2021: patched: Fixed in version 4.0.3