Executive brief
PocketMine-MP is a Minecraft Bedrock server that allows players to connect and play online. Versions 3.x before 3.27.0 do not encrypt the login protocol, allowing attackers who capture a valid player login (by tricking them to connect to an attacker-controlled server) to replay that login and impersonate the victim for up to 2-3 days until the authentication token expires.
Technical details
This is an authentication bypass vulnerability stemming from incomplete implementation of the Minecraft Bedrock protocol. PocketMine-MP 3.x verifies JWT tokens signed by Microsoft but does not implement the required protocol encryption layer, which prevents verification that a connecting client actually possesses the private key matching its public key in the authentication token. An attacker who captures a login packet (via man-in-the-middle or social engineering) can replay it to the server without possessing the victim's private key. Without encryption, the server cannot detect this impersonation. The attack is limited to the JWT token expiry window (typically 2-3 days). Fixed in versions 3.27.0 and 4.0.0 by implementing protocol encryption.
Affected products
- PocketMine PocketMine-MP 3.x before 3.27.0
Timeline
- 2022-01-21: disclosed
- 2022-01-21: patched: Backported to 3.27.0