CVE-2021-48006
LowCVSS 3.3Summary
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
Risk Assessment
The risk is that an unauthorized operator may retain operator privileges, potentially leading to abuse such as server configuration changes or privilege escalation.
Recommendation
Upgrade PocketMine-MP to version 4.0.3 or later, which includes the fix for case-insensitive operator removal.
Other vulnerabilities in PocketMine-MP
See all- CVE-2022-51009High
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
- CVE-2022-51008Medium
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
- CVE-2021-48007Medium
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
- CVE-2020-37277Medium
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.
- CVE-2023-7332High
PocketMine-MP versions prior to 4.18.1 have an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request dropping more items than available in the hotbar, causing a server crash and denial of service.
Original NVD description (English source)
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.