Executive brief
PocketMine-MP is a Minecraft server implementation. A flaw in chat message handling allows attackers to send maliciously crafted messages containing many newlines to cause the server to lock up for seconds or minutes, disrupting service availability for all connected players.
Technical details
The vulnerability is a denial-of-service flaw in chat message processing. PocketMine-MP enforces a 512-character limit on individual chat messages but fails to validate the total length of the incoming message blob before splitting it by newline characters (\n). An attacker with low privileges (ability to connect as a player) can craft a multi-megabyte message containing only newlines, which the server will parse into a very large array and iterate over, consuming significant CPU time. Additionally, rate limiting checks occur after message parsing rather than before, allowing an attacker to bombard the server with thousands of such messages. The fix (version 4.2.10) validates total message length upfront and limits message splits to a maximum of 3 parts.
Affected products
- PocketMine PocketMine-MP before 4.2.10
Timeline
- 2022-05-22: disclosed: GitHub Security Advisory GHSA-gj94-v4p9-w672 published
- 2022-05-22: patched: Fix included in version 4.2.10 (commit df33e17)