Miggo Logo
Miggo Vulnerability Database
→
GHSA-h6j3-j35f-v2x7

GHSA-h6j3-j35f-v2x7: PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

7.5

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-h6j3-j35f-v2x7
EPSS Score
-
CWE
-
Published
3/6/2024
Updated
5/15/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pocketmine/pocketmine-mpcomposer< 5.11.15.11.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from JsonMapper's ability to hydrate objects from scalar JSON values without proper validation. Key points:

  1. The JsonMapper::mapArray function lacked strict type checking for array elements (fixed in pmmp/netresearch-jsonmapper@b96a209)
  2. PocketMine's login handling code (ProcessLoginTask.php and LoginPacketHandler.php) used JsonMapper without enabling bStrictObjectTypeChecking prior to patching
  3. This combination allowed attackers to send scalar values where objects were expected, creating improperly initialized objects with missing @required properties that crashed when accessed
  4. The patch explicitly adds bStrictObjectTypeChecking=true in all affected mapping locations, confirming these were the vulnerable code paths

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n *tt**k*r *oul* *r*s* Po*k*tMin*-MP *y s*n*in* m*l*orm** JSON in Lo*inP**k*t. [n*tr*s**r**/jsonm*pp*r](*ttps://*it*u*.*om/*w*isk*/JsonM*pp*r) *llows o*j**ts to ** *y*r*t** *rom s**l*r typ*s in JSON. *ow*v*r, *u* to t** l**k o* v*li**tio

Reasoning

T** vuln*r**ility st*ms *rom JsonM*pp*r's **ility to *y*r*t* o*j**ts *rom s**l*r JSON v*lu*s wit*out prop*r v*li**tion. K*y points: *. T** JsonM*pp*r::m*p*rr*y *un*tion l**k** stri*t typ* ****kin* *or *rr*y *l*m*nts (*ix** in pmmp/n*tr*s**r**-jsonm*p