-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| de.themoep:inventorygui | maven | < 1.6.5 | 1.6.5 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability lies in a desynchronization issue between the visual inventory presented to the player and the actual backing inventory storage, specifically when using GuiStorageElement. The analysis of the patch commit 690fc91d137c6cc04f6ed3a89449050964dd8cb9 reveals the root cause and the affected functions.
The core of the vulnerability is in the click and drag handling logic. The original code had several weaknesses:
GuiStorageElement constructor, the click handler (setAction) did not adequately verify that the item displayed in the GUI (slotItem) matched the item in the backing storage (storageItem) before performing an action. This allowed a player to get the GUI into an inconsistent state that could be exploited.InventoryGui.onInventoryDrag method used an insufficient validation function (validateItemPlace), which could be bypassed to create duplicated items.InventoryGui.storeItems method. This method, called on inventory close or page change, would save the (potentially manipulated) state of the visual GUI back to the storage, making the item duplication permanent. The patch completely removes this method.The fix involves three main changes:
GuiStorageElement click handler to detect and correct any desynchronization between the visual slot and the backing storage before any click action is processed.onInventoryDrag with a direct and safer update to the storage.storeItems method entirely, thus eliminating the flawed synchronization trigger.Therefore, the vulnerable functions are the GuiStorageElement constructor where the faulty click handler is defined, the onInventoryDrag event handler, and the now-removed storeItems method which finalized the duplication.
de.themoep.inventorygui.GuiStorageElement.<init>src/main/java/de/themoep/inventorygui/GuiStorageElement.java
de.themoep.inventorygui.InventoryGui.onInventoryDragsrc/main/java/de/themoep/inventorygui/InventoryGui.java
de.themoep.inventorygui.InventoryGui.storeItemssrc/main/java/de/themoep/inventorygui/InventoryGui.java
Ongoing coverage of React2Shell