Denial of Service Vulnerability in PocketMine-MP

PocketMine-MP versions prior to 4.7.2 contain a vulnerability in the handling of skin geometry data parsed via the adhocore/json-comment library. The issue arises from the application's failure to properly handle exceptions triggered during the parsing of malformed or invalid JSON input within skin geometry packets. An unauthenticated attacker can exploit this by sending specially crafted login or skin packets containing invalid JSON structure. When the application attempts to parse this data, it triggers an unhandled RuntimeException, which leads to an immediate server crash, resulting in a denial-of-service (DoS) condition. This vulnerability (CVE-2022-51009) is significant because it allows remote, unauthenticated attackers to disrupt server availability by sending malicious packets. Defenders should prioritize patching to version 4.7.2 or later to mitigate this risk.

Impact

Successful exploitation of this vulnerability results in an immediate service crash, rendering the Minecraft server instance unavailable to legitimate players. This denial-of-service condition directly impacts availability for all hosted game instances running affected versions of PocketMine-MP, requiring manual intervention by administrators to restore service.

Recommendation

• Patch the PocketMine-MP software to version 4.7.2 or later immediately to address CVE-2022-51009.
• Monitor game server process logs for repeated runtime exceptions or sudden termination signals that coincide with login or player skin update activity.
• Review perimeter and server-side traffic logs for spikes in malformed packets targeting the Minecraft game protocol port.