GitHub Advisoryadvisory · Packagist
GHSA-xh99-hw7h-wf63 Unchecked validity of Facing values in PlayerActionPacket
HIGH
Official page ↗
- Ecosystem
- Packagist
- Packages
- pocketmine/pocketmine-mp
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Reviewed
- 2022-01-13
Affected packages
• Packagist pocketmine/pocketmine-mp: < 4.0.6 → fixed in 4.0.6
Description
Impact
A remote attacker may crash a server by sending `PlayerActionPacket` with invalid facing values (e.g. negative), specifically with `START_BREAK` or `CRACK_BLOCK` actions, or with a `UseItemTransactionData` (typically in `InventoryTransactionPacket`).
Patches
f126479c37ff00a717a828f5271cf8e821d12d6c
Workarounds
Using a plugin, cancel `DataPacketReceiveEvent` if the packet is `PlayerActionPacket` and the facing is outside the range 0-5 when receiving START_BREAK or CRACK_BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases.
For more information
If you have any questions or comments about this advisory:
• Email us at [email protected]