CVE-2023-54392: PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket
PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.22.3 - Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
PocketMine-MP 4.x deployments from 4.20.0 up to, but not including, 4.22.3 are affected. In the 5.x branch, versions before 5.2.1 are affected.
What access does an attacker need to crash a server?
An attacker needs player-level access sufficient to send a crafted BlockActorDataPacket. No user interaction is required after the malicious packet is sent.
What happens when the issue is exploited?
A crafted packet containing sign NBT data with an incorrect tag type triggers an unhandled UnexpectedTagTypeException. This terminates the server process, causing a denial of service.
How can administrators determine whether they are vulnerable?
Check the running PocketMine-MP version. Versions in the affected 4.x range below 4.22.3, or 5.x versions below 5.2.1, should be treated as vulnerable.