CVE-2021-48006: PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.0.3 - Operational
If affected, manually remove the operator entry from ops.txt because PocketMine-MP before 4.0.3 cannot revoke operators via deop when ops.txt contains non-lowercase letters (removeOp lowercases the supplied name but only removes an exactly matching entry).
Event History
Frequently Asked Questions
Who is exposed to this issue?
PocketMine-MP deployments before 4.0.3 are affected when an operator entry in ops.txt contains one or more non-lowercase letters. The issue concerns attempts to revoke that player's operator privileges with the deop command.
What does an attacker need to exploit this behavior?
The affected player must already have an operator entry stored with non-lowercase letters. When an administrator uses deop, the name is lowercased for removal but does not match the differently cased entry, so the player retains operator privileges.
How can operators mitigate the issue if they cannot upgrade immediately?
Manually remove the affected operator entry from ops.txt. This is necessary because the deop command may fail to remove entries whose stored capitalization differs from the lowercased name.
How can an administrator determine whether a deop action failed?
Inspect ops.txt after using deop, particularly for entries containing uppercase or mixed-case letters. If the entry remains, that player may still retain operator privileges.