CVE-2022-51017: PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 3.26.5 - Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.0.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any player able to submit skin data to an affected PocketMine-MP server can exploit it. The vector is network-accessible and requires no privileges or user interaction.
Which deployments are affected?
PocketMine-MP versions earlier than 3.26.5 and 4.0.5 are affected. The issue arises when player-supplied skin data fields are accepted without length validation.
What is the impact of a successful exploit?
Oversized skinID or geometryName values can exceed the 32767-byte NBT TAG_String limit and trigger an exception during NBT serialization. This causes the server to crash, resulting in denial of service.