CVE-2023-54355: PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.3.1 - Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.23.1
Event History
Frequently Asked Questions
Which deployments are affected?
PocketMine-MP versions before 5.3.1 and before 4.23.1 are affected. The issue occurs in login handling when the identityPublicKey is not validated as using the required secp384r1 curve.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What can an attacker do with this issue?
An attacker can submit a crafted LoginPacket containing a key from a different curve or a non-EC key type. It can pass login verification and cause an uncaught exception during ECDH key derivation, crashing the server.
What versions address the issue?
Upgrade to PocketMine-MP 5.3.1 or 4.23.1, depending on the release branch in use.