CVE-2023-54395: PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.12.5 - Compensating control
Mitigate ongoing attacks by rate-limiting or blocking traffic that sends oversized ModalFormResponsePacket/large JSON payloads to reduce CPU exhaustion until the server is upgraded to 4.12.5.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the PocketMine-MP server and low-privileged access sufficient to send modal form response packets. No user interaction is required.
What is the operational impact of exploitation?
An attacker can repeatedly send oversized JSON payloads in modal form response packets, consuming CPU resources. This can prevent the server from processing legitimate connections.
Which deployments are affected?
PocketMine-MP versions before 4.12.5 are affected. The provided information does not identify any configuration prerequisite beyond processing ModalFormResponsePacket traffic.