PT-2026-88984 · Pmmp+2 · Pocketmine-Mp+1

Aderoian

+1

·

CVE-2023-54393

·

Published

2023-06-06

·

Updated

2026-09-09

CVSS v4.0
CVSS v3.1

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.
This happened due to a bug in netresearch/jsonmapper. The library wasn't doing proper checks when mapping JSON arrays and objects onto scalar model properties such as strings.

Patches

The problem was fixed in a fork of JsonMapper in dktapps/JsonMapper@a31902a31f5b6fdb832f57c0e3a3f16a3b41c012. PocketMine-MP releases 4.20.5 and 4.21.1 have been released with the fix.

Workarounds

  • Users of PocketMine-MP source installations may manually install the patched version of JsonMapper by backporting commit pmmp/PocketMine-MP@09668a37d66c6023685a948b7550c918620e98f2.
  • A plugin may also be able to workaround this issue by using DataPacketReceiveEvent to attempt detection of suspicious payloads. An ErrorException will be thrown in the crash case, which can be caught by plugins.

References

cweiske/jsonmapper#210

Exploit

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-54393
GHSA-PQP3-8RRW-G8VM

Affected Products

Pocketmine-Mp
Pocketmine/Pocketmine-Mp