Executive brief
PocketMine-MP is a popular server software for Minecraft: Pocket Edition. A flaw in how the server handles modal form response packets allows attackers to send large JSON payloads that consume excessive CPU resources, preventing the server from responding to legitimate player connections and causing service outages.
Technical details
The vulnerability is an algorithmic complexity issue (CWE-407) in ModalFormResponsePacket processing. The server contained a workaround for an old client bug that caused it to spend significant time parsing very large JSON payloads in modal form responses. An attacker with network access and low privileges (connected to the server) can send numerous oversized packets to exhaust CPU resources and prevent timely processing of other connections. The vulnerability was patched in version 4.12.5 by removing the inefficient workaround code (commit 3baa5ab). No user interaction is required; the attack occurs purely through malicious packet transmission.
Affected products
- PocketMine PocketMine-MP before 4.12.5
Timeline
- 2023-01-09: disclosed: GitHub advisory GHSA-7m9r-rq9j-wmmh published
- 2023-01-09: patched: Fix released in version 4.12.5 (commit 3baa5ab)