Executive brief
PocketMine-MP is a server software for Minecraft: Bedrock Edition. Versions before 4.4.2 fail to validate item IDs sent by game clients, allowing attackers to send crafted inventory data that triggers an uncaught exception and crashes the server, disrupting service for all players.
Technical details
The vulnerability exists in the TypeConverter class's netItemStackToCore() method, which converts network itemstack data received from clients into internal representation. Item IDs are stored as TAG_Int values in NBT data, allowing a 32-bit signed range (−2³¹ to 2³¹−1), but the internal item ID system only supports a 16-bit signed range (−32768 to 32767). No bounds checking was performed on incoming item IDs, causing out-of-bounds values to trigger an uncaught TypeConversionException. An authenticated attacker can exploit this by sending crafted itemstack NBT with arbitrary item IDs via the network, crashing the server. The fix validates that item IDs fall within the valid range and throws a handled exception otherwise. This requires low privileges (user authentication) and network access to a PocketMine-MP server.
Affected products
- PocketMine PocketMine-MP before 4.4.2
Timeline
- 2022-06-07: disclosed: Security advisory GHSA-fqx3-r75h-vc89 published
- 2022-06-07: patched: Fix released in version 4.4.2 (commit 5fd685e)