CVE-2023-54396: PocketMine-MP before 4.8.1 Server Crash via Banner NBT
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pocketmine-mpto a version that resolves this vulnerability.Fixed in 4.8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges and network access. They must be able to submit crafted banner NBT data through an inventory transaction or a command.
What is the impact of successful exploitation?
Successful exploitation can trigger undefined offset errors and crash the PocketMine-MP server. The stated impact is limited to availability; no confidentiality or integrity impact is indicated.
Which installations are affected?
PocketMine-MP versions before 4.8.1 are affected. The issue is triggered when the server deserializes banner NBT data containing invalid dye color IDs.