CVE-2022-51010: PocketMine-MP before 4.4.2 Server Crash via Item ID
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.4.2 - Compensating control
Until upgraded, restrict/limit client access to the PocketMine-MP server to reduce exposure to crafted item IDs that can crash the server.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the PocketMine-MP server and low-privileged access sufficient to send client itemstack NBT data. No user interaction is required.
What is the impact of successful exploitation?
A crafted out-of-range item ID can trigger an uncaught exception and crash the server, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
Which installations are affected?
PocketMine-MP versions before 4.4.2 are affected. The available information does not identify any configuration prerequisite or workaround.