GHSA-8jq6-w5cg-wm45: Pocketmine/pocketmine mp Exploitable Inventory Component Chaining Vulnerability

HIGH
Share
CWE-400
Published
Advisory Summary

GHSA-8jq6-w5cg-wm45 is a HIGH exploitable inventory component chaining vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Pocketmine/pocketmine mp libraries in the Packagist ecosystem. The issue involves exploitable inventory component chaining in pocketmine-mp. Remediation is available by upgrading affected packages to version 3.15.4.

GHSA-8jq6-w5cg-wm45 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-8jq6-w5cg-wm45
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product Pocketmine/pocketmine mp
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix GHSA-8jq6-w5cg-wm45

To remediate this vulnerability, upgrade all affected Pocketmine/pocketmine mp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pocketmine/pocketmine-mp fixed: 3.15.4 
Upgrade pocketmine/pocketmine-mp to 3.15.4
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for pocketmine/pocketmine-mp

How to Check if You Are Affected

To determine whether your application is affected by GHSA-8jq6-w5cg-wm45, inspect your project dependencies for Pocketmine/pocketmine mp:

inspect dependencies for pocketmine/pocketmine-mp

Analyze the terminal output to locate any version of Pocketmine/pocketmine mp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.15.4), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Pocketmine/pocketmine mp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Specially crafted `InventoryTransactionPacket`s sent by malicious clients were able to exploit the behaviour of `InventoryTransaction->findResultItem()` and cause it to take an abnormally long time to execute (causing an apparent server freeze). The affected code is intended to compact conflicting `InventoryActions` which are in the same `InventoryTransaction` by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential. The problem was fixed by bailing when ambiguities are detected. **At the time of writing, this exploit is being used in the wild by attackers to deny service to servers.** ### Patches Upgrade to 3.15.4 or newer. ### Workarounds No practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to `DataPacketReceiveEvent`. ### References c368ebb5e74632bc622534b37cd1447b97281e20 ### For more information If you have any questions or comments about this advisory: * Email us at [team@pmmp.io](mailto:team@pmmp.io)

GHSA-8jq6-w5cg-wm45 Affected Pocketmine/pocketmine mp Versions

1 component(s)
Fixed Versions:
3.15.4
Product / Package Ecosystem Affected Versions Fixed Version
pocketmine/pocketmine-mp
 Packagist
< 3.15.4
3.15.4

References

GitHub Advisory / Wiki ADVISORY
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45

Frequently Asked Questions

What is GHSA-8jq6-w5cg-wm45?
GHSA-8jq6-w5cg-wm45 is a security vulnerability in Pocketmine/pocketmine mp involving Exploitable inventory component chaining in PocketMine-MP under CWE-400: Uncontrolled Resource Consumption.
Which Pocketmine/pocketmine mp versions are affected?
Affected versions include releases prior to 3.15.4 across affected packages: pocketmine/pocketmine-mp.
What version fixes GHSA-8jq6-w5cg-wm45?
Upgrading to 3.15.4 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pocketmine/pocketmine-mp affected?
Yes, pocketmine/pocketmine-mp is affected in releases prior to 3.15.4. Upgrade your dependency to 3.15.4 or later.
What CWE is associated with GHSA-8jq6-w5cg-wm45?
GHSA-8jq6-w5cg-wm45 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check Packagist dependencies for GHSA-8jq6-w5cg-wm45?
Run the dependency tree command: 'inspect dependencies for pocketmine/pocketmine-mp'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8jq6-w5cg-wm45",
  "modified" : "2020-11-11T21:38:07Z",
  "published" : "2020-11-11T21:38:18Z",
  "aliases" : [ ],
  "summary" : "Exploitable inventory component chaining in PocketMine-MP",
  "details" : "### Impact\nSpecially crafted `InventoryTransactionPacket`s sent by malicious clients were able to exploit the behaviour of `InventoryTransaction->findResultItem()` and cause it to take an abnormally long time to execute (causing an apparent server freeze).\n\nThe affected code is intended to compact conflicting `InventoryActions` which are in the same `InventoryTransaction` by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential.\n\nThe problem was fixed by bailing when ambiguities are detected.\n\n**At the time of writing, this exploit is being used in the wild by attackers to deny service to servers.**\n\n### Patches\nUpgrade to 3.15.4 or newer.\n\n### Workarounds\nNo practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to `DataPacketReceiveEvent`.\n\n### References\nc368ebb5e74632bc622534b37cd1447b97281e20\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "pocketmine/pocketmine-mp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.15.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-11-11T21:38:07Z",
    "nvd_published_at" : null
  }
}