Skip to content

Crash when handling unexpected `NULL` values in JSON arrays in `LoginPacket`

High
dktapps published GHSA-92jh-gwch-jq38 Sep 13, 2023

Package

composer pocketmine/pocketmine-mp (Composer)

Affected versions

<= 5.3.0, <= 4.23.0

Patched versions

5.3.1, 4.23.1

Description

Impact

An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.

This happened because of unexpected validation behaviour in netresearch/jsonmapper. The library allows NULL in arrays whose types don't expect NULL, even when bStrictNullTypes is set.

Code processing arrays in the JSON data could then crash due to unexpected NULL elements.

Patches

This problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8d

An upstream patch for this issue was proposed via cweiske/jsonmapper#211; however, as of 2024-05-15, the issue has not yet been fixed upstream due to debate about how to deal with the problem. For now, a fork of JsonMapper is used by PocketMine-MP to workaround the issue.

Workarounds

A plugin may handle DataPacketReceiveEvent for LoginPacket and check that none of the input arrays contain NULL where it's not expected, but this is rather cumbersome.

References

Proposed upstream fix for the problem: cweiske/jsonmapper#211

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID

No known CVE

Weaknesses

No CWEs

Credits