Miggo Logo
Miggo Vulnerability Database
→
GHSA-92jh-gwch-jq38

GHSA-92jh-gwch-jq38: PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

7.5

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-92jh-gwch-jq38
EPSS Score
-
CWE
-
Published
9/14/2023
Updated
5/23/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pocketmine/pocketmine-mpcomposer>= 5.0.0, <= 5.3.05.3.1
pocketmine/pocketmine-mpcomposer<= 4.23.04.23.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from JsonMapper's array handling logic. The commit diff shows critical changes in mapArray() where null acceptance in typed arrays was removed. Previously, when encountering a null value in JSON arrays (e.g., in LoginPacket data), JsonMapper would insert null into PHP arrays even when the target type declaration didn't allow null. This caused type inconsistencies that crashed PocketMine-MP when processing these arrays. The mapArray function is directly responsible for this type mapping behavior, and its pre-patch implementation matches the vulnerability description of accepting unexpected nulls in typed arrays.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n *tt**k*r *oul* *r*s* Po*k*tMin*-MP *y s*n*in* m*l*orm** JSON in `Lo*inP**k*t`. T*is **pp*n** *u* to t** p*rti*ul*r **n*lin* o* NULL typ*s in t** json m*pp*r w*i** ****pts NULL typ* v*lu*s in typ** *rr*ys w*i** Po*k*tMin*-MP *i* not *xp

Reasoning

T** vuln*r**ility st*ms *rom JsonM*pp*r's *rr*y **n*lin* lo*i*. T** *ommit *i** s*ows *riti**l ***n**s in `m*p*rr*y()` w**r* null ****pt*n** in typ** *rr*ys w*s r*mov**. Pr*viously, w**n *n*ount*rin* * null v*lu* in JSON *rr*ys (*.*., in `Lo*inP**k*t