Executive brief
PocketMine-MP is a Minecraft server implementation. An unhandled exception during parsing of player skin data allows remote attackers to crash the server by sending login or skin packets with malformed JSON, disrupting service for all connected players.
Technical details
The vulnerability is a denial of service caused by inadequate exception handling in the Skin class when parsing JSON skin geometry data using the adhocore/json-comment library. The library throws a RuntimeException on invalid JSON, but PocketMine-MP expected a boolean return value and did not catch the exception. An unauthenticated attacker on the network can trigger the crash by sending a login packet or player skin packet containing invalid geometry JSON, with no user interaction required. The fix (commit c9626c6) adds proper exception handling around the commented JSON decoder.
Affected products
- PocketMine PocketMine-MP before 4.7.2
Timeline
- 2022-08-16: disclosed
- 2022-08-16: patched: version 4.7.2 released with fix commit c9626c6