GHSA-wjf6-3h6v-4gq9: Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker needs the player to have an attacker-controlled web page open in their browser. That page can make a cross-site connection to the unauthenticated loopback WebSocket and send cmd messages without requiring prior privileges.
What level of access can a successful attacker obtain?
Commands received through the affected HostLink path are passed to WorldBridge.command() and run with operator authority. This allows remote execution of Minecraft commands on the affected player's instance.
Which code is affected?
The issue affects the HostLink class used by the passthrough example mods in versions before commit e88f6876745427321eb755ebc98276063a962d8a.