CVE-2022-51014: PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be able to connect to the PocketMine-MP server and send form response packets. The attack requires low privileges and no user interaction.
What is the impact of successful exploitation?
A malformed JSON form response can trigger an uncaught InvalidArgumentException in the ModalFormResponsePacket handler, causing the server to crash. The reported impact is denial of service; no confidentiality or integrity impact is stated.
Which versions should be remediated?
PocketMine-MP versions before 4.0.7 are affected. Update to version 4.0.7 or later.