https://feed.craftedsignal.io/products/pocketmine-mp/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 02 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-pocketmine-logdos/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-pocketmine-logdos/Attackers can cause a denial-of-service on PocketMine-MP servers by sending a crafted Minecraft LoginPacket containing large or complex structures in the clientData JWT body, leading to excessive logging and potential server crashes.A denial-of-service vulnerability affects PocketMine-MP servers due to insufficient validation of the LoginPacket. An attacker can exploit this by sending a specially crafted packet containing a large or complex JSON structure within the clientData JWT body's unknown properties. The PocketMine-MP server, versions prior to 5.4.1, processes this malformed data, generating excessively long log messages. This excessive logging consumes significant CPU resources and memory, and can ultimately lead to a crash due to the server attempting to serialize the large, offending data structure for logging. The issue stems from the JsonMapper instance being configured to warn instead of reject unexpected properties, which, while intended to accommodate changes from Microsoft, creates an exploitable vulnerability.

Attack Chain

1. An attacker crafts a custom Minecraft client.
2. The client generates a LoginPacket to initiate a connection with the PocketMine-MP server.
3. Within the LoginPacket, the clientData field contains a JWT body.
4. The attacker injects a custom, unexpected JSON property (e.g., "invalid_key") into the JWT body of the clientData.
5. The value of the "invalid_key" is set to a large or complex object, such as a deeply nested array or an array with millions of elements.
6. The server receives the LoginPacket and processes the clientData JWT.
7. The server's JsonMapper encounters the unexpected "invalid_key" property.
8. The server's warnUndefinedJsonPropertyHandler attempts to serialize and log the large object value, leading to excessive resource consumption, and eventually an Out-of-Memory crash.

Impact

Successful exploitation of this vulnerability results in a denial-of-service condition on the PocketMine-MP server. The excessive logging can rapidly consume disk space and CPU resources, degrading server performance for legitimate users. In severe cases, the server may crash entirely due to memory exhaustion. This vulnerability affects PocketMine-MP servers exposed to public networks where unauthorized actors can send malicious login packets. The number of potential victims is any server running a vulnerable PocketMine-MP version (< 5.4.1) accessible to the public internet.

Recommendation

• Upgrade PocketMine-MP to version 5.4.1 or later to apply the patch that removes the vulnerable var_export and limits the logged property name length (reference: Patches section).
• Implement a plugin that handles the DataPacketReceiveEvent to inspect LoginPacket data and use JsonMapper to reject packets with unusual properties. This will prevent the processing of malicious packets (reference: Workarounds section).
• Monitor server logs for unusually long messages or repeated warnings about undefined JSON properties within clientData. This can be an indicator of exploitation attempts.
• Deploy the provided Sigma rule to detect connection attempts with unusually large client data in the login packet.

]]>highadvisoryminecraftlogdospocketmine-mpdenial-of-servicehttps://feed.craftedsignal.io/briefs/2024-01-02-pocketmine-dos/Tue, 02 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-pocketmine-dos/A vulnerability in PocketMine-MP servers allows an attacker to cause a denial-of-service by sending a malformed ModalFormResponsePacket containing an excessively large JSON payload, impacting server performance and availability.PocketMine-MP, a popular server software for Minecraft: Bedrock Edition, is susceptible to a denial-of-service (DoS) vulnerability due to insufficient validation of ModalFormResponsePacket data. An attacker can exploit this by sending a crafted packet containing an extremely large JSON payload within the formData field. This causes the server to consume excessive CPU and memory resources while attempting to parse the oversized JSON, potentially leading to unresponsiveness or complete server failure. The vulnerability affects PocketMine-MP servers running versions prior to 5.39.2. Exploitation requires a player to establish a full session on the server. The issue was patched with size limitations on form responses (cef1088341e40ee7a6fa079bca47a84f3524d877) and preventing decoding of responses with invalid form IDs (f983f4f66d5e72d7a07109c8175799ab0ee771d5).

Attack Chain

1. The attacker connects to a vulnerable PocketMine-MP server as a legitimate player.
2. The attacker establishes a full session by spawning into the game world.
3. The attacker crafts a ModalFormResponsePacket using a modified client or packet-sending script.
4. The formId field in the packet is set to an invalid or non-existent form ID (e.g., 9999).
5. The formData field is populated with an extremely large JSON array (e.g., 10+ MB payload, such as [0,0,0,...]).
6. The attacker sends the crafted ModalFormResponsePacket to the server.
7. The server receives the packet and attempts to parse the oversized JSON payload in the formData field, despite the invalid formId.
8. The server consumes excessive CPU and memory resources during JSON parsing, leading to performance degradation or a complete freeze, resulting in a denial-of-service.

Impact

Successful exploitation of this vulnerability results in a denial-of-service condition on the affected PocketMine-MP server. The server becomes unresponsive, preventing legitimate players from connecting or continuing their gameplay. The number of affected users depends on the server's player capacity. Unpatched servers are vulnerable to resource exhaustion attacks that can severely impact the game experience and potentially require a server restart. All sectors relying on public Minecraft: Bedrock Edition servers are potentially at risk.

Recommendation

• Upgrade PocketMine-MP servers to version 5.39.2 or later to apply the patches that address the vulnerability (cef1088341e40ee7a6fa079bca47a84f3524d877 and f983f4f66d5e72d7a07109c8175799ab0ee771d5).
• Implement rate limiting on ModalFormResponsePacket processing to mitigate the impact of large packet floods (network_connection).
• Deploy the Sigma rule provided below to detect suspicious ModalFormResponsePacket sizes indicative of exploitation attempts (network_connection).

]]>highadvisorypocketmine-mpdenial-of-serviceminecraft