CVE-2023-54393: PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.20.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PocketMine-MP deployments running a version earlier than 4.20.5 are affected. The issue is reachable through LoginPacket processing, so servers that accept client login traffic are exposed.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without authentication or user interaction by sending malformed JSON structures in a LoginPacket. Successful exploitation crashes the server, causing a denial of service.
What is the impact of exploitation?
The documented impact is server availability loss: the malformed LoginPacket can crash the PocketMine-MP server. No confidentiality or integrity impact is indicated by the supplied severity vector.
What is the remediation?
Upgrade PocketMine-MP to version 4.20.5 or later. Versions before 4.20.5 contain the improper JSON validation issue in the JsonMapper dependency.