GitHub Advisoryadvisory · Packagist

GHSA-7m9r-rq9j-wmmh PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

MEDIUM Published 2023-01-10 Modified 2023-01-10 Official page ↗
Ecosystem
Packagist
Packages
pocketmine/pocketmine-mp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Reviewed
2023-01-10

Affected packages

• Packagist pocketmine/pocketmine-mp: < 4.12.5 → fixed in 4.12.5

Description

Impact Due to a workaround for an old client bug (which has since been fixed), very large JSON payloads in `ModalFormResponsePacket` were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the server from processing other connections in a timely manner. Patches The problem has been addressed in 3baa5ab71214f96e6e7ab12cb9beef08118473b5 by removing the workaround code. Workarounds Plugins could cancel `DataPacketReceiveEvent` for this packet, decode the data their way, and then call `Player->onFormSubmit()` directly, bypassing the vulnerable code.

References