CVE-2023-37262
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The CC: Tweaked mod for Minecraft prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 does not blacklist metadata API endpoints by default on popular cloud hosting providers like AWS, GCP, and Azure. This allows players to access sensitive information, potentially leading to privilege escalation within the cloud provider.
Risk Assessment
Organizations may be exposed to sensitive data leaks and potential attacks that could lead to privilege escalation within their cloud infrastructure. This poses a serious threat to data and system security.
Recommendation
It is recommended to update the CC: Tweaked mods to versions that include fixes to block access to metadata API endpoints. Additionally, conducting a security audit of the Minecraft server is advisable to minimize risks.
Original NVD description (English source)
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.