Dktapps

Improper validation of multiple `ResourcePackClientResponsePacket` packets with `STATUS COMPLETED` status occurs during resource pack handling. This allows malicious clients to send batches of these packets to repeatedly trigger pre-spawn progression, which results in the creation of duplicate Player objects and increases memory consumption and network traffic.

An issue exists during offline login authentication where the software fails to properly validate the Certificate field. Unauthenticated players can exploit this to trigger an uninitialized property access error, which results in a server crash.

A denial of service issue exists in the `LoginPacket` handler. Remote attackers can inject numerous junk properties into the `clientData` JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This occurs because the `JsonMapper` instance used to process the JWT body is configured to warn about unexpected properties rather than rejecting them. By crafting malicious login packets with excessive unknown properties, an attacker can cause the server to flood warning messages and waste CPU time, leading to degraded performance.

Authenticated players can cause a denial of service by sending `ModalFormResponsePacket` packets containing massive JSON arrays. The server fails to limit the JSON payload size, allowing an attacker to exhaust CPU and memory resources, which renders the server unresponsive. This occurs when the server processes the `formData` variable, especially if the `formId` provided does not correspond to an active form.

A denial of service issue exists in the processing of the `LoginPacket` where large or complex structures within unknown `clientData` JWT properties cause excessive logging without sanitization. Attackers can send crafted `LoginPacket` messages containing deeply nested or massive object structures to trigger out-of-memory conditions, waste CPU time during serialization, or spam the console, potentially crashing the server. This occurs because the `JsonMapper` instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them, and the `warnUndefinedJsonPropertyHandler` function attempts to export the malicious object without length limitations.

A network amplification issue exists in the handling of `ActorEventPacket`. This allows a client to trigger consuming animations for all visible players by sending crafted `ActorEventPacket` messages. This behavior can be abused to spam animation events to other clients, leading to the exhaustion of server CPU and memory resources.

The software fails to validate the despawn state of an entity when processing attack packets from clients. When an entity or player is flagged for despawn (such as during a disconnect sequence), it remains accessible in the `World` entity table. A race condition occurs when a client sends an attack packet at the exact moment an entity is disconnecting, allowing the death handler to execute multiple times. This results in the duplication of experience and inventory items, as they are dropped multiple times while the original items remain with the disconnecting player.

An issue exists in the handling of `STATUS SEND PACKS` within the `ResourcePackClientResponsePacket` where the software fails to validate the uniqueness of pack UUIDs. An authenticated client using a non-standard Bedrock client can send a packet containing multiple duplicate valid pack UUIDs in the `packIds` array. This causes the server to process and send the same resource pack multiple times, leading to rapid memory exhaustion and a resulting denial of service that can freeze or crash the server.

A denial of service issue exists in the processing of JSON data within the `LoginPacket`. Remote attackers can crash the server by sending malformed JSON data. The flaw stems from the `netresearch/jsonmapper` component, which allows objects to be hydrated from scalar JSON types. Due to a lack of validation, this can result in improperly initialized objects where required properties are not set, leading to an application crash when the code attempts to access these properties. This behavior occurs even if `bStrictObjectTypes` is disabled, as the component does not respect this setting when processing arrays.

Failure to validate that the `identityPublicKey` in the `LoginPacket` uses the required `secp384r1` elliptic curve allows attackers to bypass login verification. By providing keys using different curves or non-EC key types, an attacker can trigger an uncaught exception during ECDH (Elliptic Curve Diffie-Hellman) key derivation, which is a method used to calculate a shared secret for symmetric encryption. This results in a server crash.

A denial of service issue exists in the JSON parsing of the `LoginPacket` due to improper handling of null values within arrays. The json mapper accepts null type values in typed arrays, which the software does not expect. An attacker can send malformed JSON containing unexpected null elements in the `LoginPacket` to crash the server.

Failure to validate NBT tag types in the `BlockActorDataPacket` allows a player to crash the server. By sending a packet containing sign NBT data with an incorrect tag type, an unhandled `UnexpectedTagTypeException` is triggered, which terminates the server process. This occurs when the server expects a `CompoundTag` but receives a different type, such as a `ByteTag`, specifically within the `FrontText` variable.

A denial of service issue exists during the parsing of JSON in the `LoginPacket` due to improper validation within the `JsonMapper` dependency. The library fails to perform adequate checks when mapping JSON arrays and objects onto scalar model properties, such as strings. An attacker can exploit this by sending malformed JSON structures in the `LoginPacket` to crash the server.

The software fails to rate-limit `InventoryTransactionPacket` requests of the mismatch type. This allows an unauthenticated attacker to trigger excessive inventory synchronization by sending numerous mismatch transactions, forcing the server to transmit large amounts of serialized inventory data. This process acts as a bandwidth multiplier, consuming significant server bandwidth, particularly when dealing with large amounts of NBT (Named Binary Tag), which is a structured data format used to store item properties.