7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h6rj-3m53-887h

GHSA-h6rj-3m53-887h: PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

Impact

Attackers can put large and/or complex structures as a value to an unknown property in the clientData JWT body in the Minecraft LoginPacket, causing the server to generate very long log messages. Additionally, the property name is logged without any length limitations or sanitization, which can also be abused for LogDoS.

This may be used to spam the log/console, waste CPU time serializing the offending structure, and potentially to crash the server entirely.

This happens because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them outright. While this behaviour increases flexibility for random changes introduced by Microsoft, it also creates vulnerabilities if not handled carefully.

This vulnerability affects PocketMine-MP servers exposed to a public network where unknown actors may have access.

PoC

Connect to the server using a custom client.
Send a Minecraft LoginPacket containing an unexpected JSON property (e.g., invalid_key) within the ClientData.
Set the value of invalid_key to a highly recursive or massive object structure (e.g., an array containing millions of elements or deeply nested arrays).
The server hits the warnUndefinedJsonPropertyHandler, which attempts to var_export the malicious object, leading to an Out-of-Memory crash.

A := make([]interface{}, 1)
	ptr := &A
	for i := 0; i < 500; i++ {
		next := make([]interface{}, 1000)
		(*ptr)[0] = next
		ptr = &next
	}
	data := make([]int, 2000000)
	for i := 0; i < 100; i++ {
		data[i] = i
	}
	(*ptr)[0] = data
	d.PlayFabID = A

Patches

The issue was addressed in https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0 by removing the relevant var_export and limiting the length of the logged property name to 80 characters.

Workarounds

Plugins can handle DataPacketReceiveEvent to capture , and pre-process the clientData JWT to ensure it doesn't have any unusual properties in it. This can be achieved using (see the original affected code below) and setting the flag to . A will be thrown if the JWT is problematic.

Miggo Vulnerability Database

→

GHSA-h6rj-3m53-887h

GHSA-h6rj-3m53-887h:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pocketmine/pocketmine-mp	composer	< 5.41.1	5.41.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in how PocketMine-MP handles unexpected properties within the clientData JWT of a LoginPacket. The LoginPacketHandler uses a JsonMapper to process this data. The mapper was configured with a warnUndefinedJsonPropertyHandler that would log any unexpected properties. The core of the vulnerability is that this handler used var_export on the value of the unexpected property. As this value is attacker-controlled, a malicious actor could send a very large or deeply nested object. The var_export function would then attempt to serialize this entire object into a string for logging, consuming a large amount of CPU and memory, potentially leading to a server crash (Denial of Service). The patch addresses this by removing the var_export of the value and instead only logging the property name with a length limit. Therefore, the warnUndefinedJsonPropertyHandler function is the precise location of the vulnerability.

Vulnerable functions

pocketmine\network\mcpe\handler\LoginPacketHandler::warnUndefinedJsonPropertyHandler

src/network/mcpe/handler/LoginPacketHandler.php

The vulnerability lies in the `warnUndefinedJsonPropertyHandler` function, which is responsible for handling unexpected properties in the clientData JWT. The function used `var_export` to log the value of the unexpected property. An attacker could provide a large, complex, or recursive object as the value, causing `var_export` to consume excessive CPU and memory resources, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.