-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability analysis began by examining the provided information, which included a detailed description of the denial-of-service vulnerability, code snippets, and references to two commits. The core of the vulnerability is the server's failure to validate that resource pack IDs sent by a client are unique, leading to a resource amplification attack.
I used the get_commit_infos tool to inspect the two provided commits.
The first commit, c417ecd30d20520227b15e09eda87db492ab0a6a, modified NetworkSession::handleEncoded to abort packet processing if a disconnection has occurred. This is a general hardening measure and not the direct fix for the root cause, but it is related to the consequences of the vulnerability.
The second commit, e375437439df51f7862b6b98318394643fcd6724, directly addresses the vulnerability within ResourcePacksPacketHandler::handleResourcePackClientResponse. The patch introduces a $seen array to keep track of the pack IDs that have already been processed within the same packet. If a duplicate ID is found, it throws a PacketHandlingException, thus preventing the server from processing the same pack multiple times.
Based on this evidence, the function pocketmine\network\mcpe\handler\ResourcePacksPacketHandler::handleResourcePackClientResponse was identified as the vulnerable function. This function is directly responsible for processing the malicious ResourcePackClientResponsePacket. During an exploit, this function would be on the stack trace as it processes the amplified list of pack IDs, leading to the memory exhaustion described in the vulnerability report.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pocketmine/pocketmine-mp | composer | < 5.32.1 | 5.32.1 |