7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pqp3-8rrw-g8vm

GHSA-pqp3-8rrw-g8vm: PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency

Impact

An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.

This happened due to a bug in netresearch/jsonmapper. The library wasn't doing proper checks when mapping JSON arrays and objects onto scalar model properties such as strings.

Patches

The problem was fixed in a fork of JsonMapper in dktapps/JsonMapper@a31902a31f5b6fdb832f57c0e3a3f16a3b41c012. PocketMine-MP releases 4.20.5 and 4.21.1 have been released with the fix.

Workarounds

Users of PocketMine-MP source installations may manually install the patched version of JsonMapper by backporting commit pmmp/PocketMine-MP@09668a37d66c6023685a948b7550c918620e98f2.
A plugin may also be able to workaround this issue by using DataPacketReceiveEvent to attempt detection of suspicious payloads. An ErrorException will be thrown in the crash case, which can be caught by plugins.

References

cweiske/jsonmapper#210

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pqp3-8rrw-g8vm

GHSA-pqp3-8rrw-g8vm:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pocketmine/pocketmine-mp	composer	< 4.20.5	4.20.5
pocketmine/pocketmine-mp	composer	>= 4.21.0, < 4.21.1	4.21.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from JsonMapper's failure to handle type mismatches between JSON structures and target class properties. The critical code in JsonMapper::map() previously only checked for object-to-string conversions but didn't validate() other incompatible type mappings (e.g., array-to-string). The patched commit shows the fix involved adding comprehensive type checks using isFlatType(), confirming the vulnerable logic resided in this mapping function. The high confidence comes from: 1) The vulnerability was explicitly attributed to JsonMapper's type handling 2) The fix directly modifies this function 3) Test cases demonstrate array/object-to-string conversion attempts being properly blocked after the fix.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.