CVE-2022-51013: PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pocketmine-mpto a version that resolves this vulnerability.Fixed in 4.2.3 - Compensating control
Until upgraded, restrict inbound access to PocketMine-MP so untrusted clients cannot send malformed itemstack NBT tool/armor metadata that can trigger unhandled exceptions and server crashes.
Event History
Frequently Asked Questions
Who can exploit this issue?
A client with low-privileged access to a vulnerable PocketMine-MP server can exploit it remotely. No user interaction is required.
What input triggers the crash?
An attacker sends itemstack NBT containing negative or out-of-range damage metadata values for tool or armor items. The invalid values cause an unhandled exception in the Durable class.
Are all affected installations exposed by default?
The issue affects PocketMine-MP versions before 4.2.3 when they process client-supplied itemstack NBT for tool or armor items. The provided data does not identify any configuration setting that disables the affected processing.
What should operators do if they cannot update immediately?
The provided data identifies no workaround or mitigation. Updating to PocketMine-MP 4.2.3 or later is the documented version boundary for addressing the issue.