Vulnerability GHSA-pg53-p7qp-65cv
Summary
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
Details
Summary
During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.
Impact
Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.
Workarounds
Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.
Patches
This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
