CVE-2023-54390: PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.3.1 - Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.23.1
Event History
Frequently Asked Questions
Which versions need to be updated?
PocketMine-MP versions before 5.3.1 and before 4.23.1 are affected. Update to 5.3.1 or 4.23.1, as applicable to the release branch in use.
Does an attacker need authentication or user interaction to crash a vulnerable server?
No. The vulnerability has network attack vector, low attack complexity, no required privileges, and no user interaction requirement. An attacker can send a malformed LoginPacket containing JSON arrays with unexpected null elements.
What is the impact of successful exploitation?
Successful exploitation can crash the PocketMine-MP server, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.