Skip to content

PCL 日志中包含 Minecraft 登录的 AccessToken

Low
LTCatt published GHSA-22mj-jjhv-rxm4 Oct 15, 2025

Package

Plain Craft Launcher (VB.NET)

Affected versions

2.10.8

Patched versions

> 2.10.8

Description

我看不懂，能一句话解释发生了什么吗？

出了个 Bug，但开发者在有人利用这个 Bug 之前就修好了。
如果你之前将 PCL 的日志（不是 Minecraft 错误报告）发给了他人，请继续阅读 “我需要做什么？” 小节。
如果没有，更新一下 PCL，然后就没事了……

我需要做什么？

如果你不是使用离线登录，且已经将启动过游戏的，PCL 2.10.8 版本的日志 PCL/Log[1-5].txt 直接发给了他人，请删除/撤回你发送的文件。注意，发送 Minecraft 错误报告是安全的，只有直接发送日志纯文本文件才受影响。
之后，将程序更新至最新版即可。

我之前有可能已经受到了影响吗？

目前没有收到利用此漏洞的报告，所以应当没有影响。
由于 Minecraft 崩溃报告没有受到影响，而直接发送 PCL 日志的场景又相当罕见，潜在的影响应当极小。

详情

若启动游戏，PCL 日志 PCL/Log[1-5].txt 中会包含启动游戏时用到的 AccessToken。若将该日志文件发给他人，他人可以临时使用该次启动游戏时使用的账户进入无 2FA 的 Minecraft 服务器，或调整账户设置，直至 AccessToken 过期。
PCL 导出的 Minecraft 错误报告没有受到此漏洞影响。

原因

此前，PCL 会对所有 “MC 启动日志” McLaunchLog 进行打码，这可以保护 AccessToken 不遭到泄露。
但在 2.10.8 中，为便于修复 Bug，PCL 启动进程时会将进程的参数也写入日志。由于启动进程是底层函数，其日志信息并不属于 “MC 启动日志”，所以没有触发打码函数，导致了该漏洞出现。
PCL 在导出 Minecraft 错误报告时会对导出文件的所有内容再次进行打码，所以并未受到影响。

修复措施

已对所有日志进行打码，而不仅仅是启动日志。

Severity

Low

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v4 base metrics

Exploitability Metrics
Attack Vector Local
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction Active
Vulnerable System Impact Metrics
Confidentiality None
Integrity None
Availability None
Subsequent System Impact Metrics
Confidentiality Low
Integrity None
Availability None

CVSS v4 base metrics

Exploitability Metrics
Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.
Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.
Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.
Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.
User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.
Vulnerable System Impact Metrics
Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.
Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.
Subsequent System Impact Metrics
Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.
Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

CVE ID

No known CVE

Weaknesses

Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file. Learn more on MITRE.

Credits