PT-2024-40526 · Unknown · Pocketmine-Mp

Published

2024-03-06

·

Updated

2024-03-06

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: PocketMine-MP versions prior to 5.11.2
Description: The issue occurs when a client sends a BookEditPacket with an InventorySlot greater than 35, causing the server to crash due to an unhandled exception thrown by BaseInventory->getItem(). This results in a server crash, affecting all servers. The crash happens at the /network/mcpe/handler/InGamePacketHandler.php endpoint, specifically at line 873.
Recommendations: For versions prior to 5.11.2, update to version 5.11.2 or later to resolve the issue. As a temporary workaround, consider restricting the InventorySlot value to 35 or less to prevent the server crash.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

GHSA-XC7J-WJ36-QJFR

Affected Products

Pocketmine-Mp