CVE-2024-56141
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Minosoft client for Minecraft Java Edition, the CryptManager encryption routine sets the AES initialization vector (IV) equal to the secret key instead of a random value. This vulnerability allows chosen-ciphertext/chosen-plaintext attacks, potentially leading to secret key recovery by an attacker.
Risk Assessment
An attacker can recover the encryption key, enabling decryption of communication and potential session hijacking. The risk is especially high in multiplayer environments where data is transmitted over the network.
Recommendation
Immediately stop using the Minosoft client until a patch is released. Monitor the project repository for updates and apply the fix as soon as it becomes available.
Original NVD description (English source)
Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine ( CryptManager.kt ) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available.