CVE-2023-54394: PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker able to send InventoryTransactionPacket requests to the server can exploit it. The description states that exploitation does not require authentication.
Are default deployments affected?
The provided data does not identify any configuration prerequisite. It describes missing rate limiting for mismatch-type InventoryTransactionPacket requests in affected versions, so deployments running PocketMine-MP before 4.18.0-ALPHA2 should be considered exposed.
What is the practical impact of exploitation?
An attacker can repeatedly send mismatch transactions that cause excessive inventory synchronization. This makes the server transmit large serialized inventory payloads and can consume significant bandwidth, resulting in reduced availability.
What is the remediation target?
Upgrade PocketMine-MP to 4.18.0-ALPHA2 or a later version. The issue affects versions before 4.18.0-ALPHA2.