Executive brief
PocketMine-MP is a server software for the Minecraft Pocket Edition game that handles client connections and gameplay. An attacker connected to the server can crash it by sending specially crafted form response packets with invalid JSON, disrupting service availability for all players on that server.
Technical details
The vulnerability is an unhandled exception (InvalidArgumentException) in the ModalFormResponsePacket handler's JSON decoding function. When a Minecraft Windows client sends malformed JSON that cannot be parsed by json_decode(), the stupid_json_decode() workaround function attempts to repair it but throws an uncaught InvalidArgumentException if the repair fails. This exception propagates uncaught, causing a server crash. The attack requires network access to the server (a player connection) and low privileges; no user interaction on the target is required. The fix (commit 56fe71d) changes the exception type from InvalidArgumentException to PacketHandlingException, which is properly caught by the caller.
Affected products
- PocketMine PocketMine-MP 4.0.0 to 4.0.6
Timeline
- 2022-01-21: disclosed
- 2022-01-21: patched: Fixed in version 4.0.7