CVE-2022-51016: PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MP 3.x/4.0.0to a version that resolves this vulnerability.Fixed in 4.0.0 - Upgrade
Upgrade
PocketMine-MP 3.xto a version that resolves this vulnerability.Fixed in 3.27.0 - Compensating control
Ensure the server is not directly reachable over the internet without proxying such that encryption is enabled; use a proxy with encryption enabled in front of PocketMine-MP to prevent the server from accepting replayed Xbox Live login tokens.
Event History
Frequently Asked Questions
Which deployments are exposed to login replay?
PocketMine-MP 3.x servers before 3.27.0 are affected when they are directly reachable from the internet and are not behind a proxy with encryption enabled. The issue is fixed in PocketMine-MP 4.0.0 and was backported to 3.27.0.
What does an attacker need to impersonate a player?
The attacker must capture a valid login from the victim's session, such as by persuading the player to connect to an attacker-controlled server. They can then replay that login to pass XBOX Live authentication without possessing the private key for the login token.
How long can a captured login remain usable?
A replayed login can be used until its JWT token expires. Tokens typically expire after two to three days.
What can be done if an upgrade is not immediately possible?
Avoid exposing the server directly to the internet without protection. Place it behind a proxy with encryption enabled to address the affected deployment condition.