Executive brief
PocketMine-MP is a popular Minecraft Bedrock Edition server software. Versions 4.20.0 through 4.22.2 and 5.0.0 through 5.2.0 fail to properly validate NBT (Named Binary Tag) data types in network packets, allowing any connected player to crash the server by sending a malformed sign data packet with incorrect tag types.
Technical details
The vulnerability is an insufficient input validation flaw in the BlockActorDataPacket handler. When processing sign NBT data, the code fails to validate that tag types match expected types (e.g., expecting CompoundTag but receiving ByteTag), resulting in an unhandled UnexpectedTagTypeException in the InGamePacketHandler. Attack vector is network-based with low complexity; a low-privileged player (any connected player) can exploit this without user interaction by crafting a malformed BlockActorDataPacket. Exploitation causes the server process to terminate, resulting in denial of service. The vulnerability was patched in versions 4.22.3 and 5.2.1 via commit 0c250a2, which added proper exception handling and type validation.
Affected products
- PocketMine PocketMine-MP 4.20.0 to 4.22.2, 5.0.0 to 5.2.0
Timeline
- 2023-07-14: disclosed: GitHub security advisory GHSA-7wrv-6h42-w54f published
- 2023: patched: Fixed in versions 4.22.3 and 5.2.1 via commit 0c250a2