Executive brief
PocketMine-MP is a Minecraft server implementation that allows players to connect and play online. A flaw in session management allows attackers to create many connections without completing login, consuming all available player slots and preventing legitimate players from joining the server.
Technical details
PocketMine-MP fails to limit the number of unauthenticated sessions, only enforcing max player count when the PlayerPreLoginEvent is reached (i.e. when a LoginPacket is sent). An attacker with network access can create many sessions without sending LoginPacket, causing these incomplete sessions to occupy player slots. Since unauthenticated sessions are included in the max-players check, legitimate players who do send LoginPacket are immediately disconnected as the server appears full. No authentication or user interaction is required; the attack succeeds by flooding the server with incomplete connections. The fix (commit 59be901) restricts the max-players check to include only sessions that have already passed the PlayerPreLoginEvent, ensuring only authenticated players consume slots.
Affected products
- PocketMine Project PocketMine-MP before 4.12.3
Timeline
- 2022-12-30: disclosed
- 2022-12-30: patched: Fixed in version 4.12.3