GHSA-h79x-98r2-g6qc: Pocketmine/pocketmine mp Impersonation Of Other Users (passing Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h79x-98r2-g6qc",
  "modified" : "2022-01-24T22:08:04Z",
  "published" : "2022-01-21T23:02:15Z",
  "aliases" : [ ],
  "summary" : "Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP",
  "details" : "# Impact\nMinecraft Bedrock authentication and its protocol encryption are inseparably linked. One is not complete without the other.\n\nThis vulnerability affects servers which are able to be directly connected to via the internet (i.e. not behind a proxy).\n\nIf you are using a proxy, please check that it supports protocol encryption and that it is enabled.\n\n# Technical details\n<details>\n<summary>click to expand</summary>\n\n## Basics\n\n1. The client generates a private ECC key `clientPriv` which it uses to complete ECDH for encryption.\n2. A JWT containing the public key `clientPub` corresponding to this key is signed by Microsoft servers with the [Mojang root public key](https://github.com/pmmp/PocketMine-MP/blob/stable/src/network/mcpe/auth/ProcessLoginTask.php#L42) `mojangPub`.\n3. The server verifies that the token was issued by Microsoft servers by verifying the JWT signature with `mojangPub`.\n\n## Why this is a problem\nHowever, this only ensures that the token was issued by Microsoft. It does _not_ ensure that the client actually possesses the private key corresponding to the public key in the token.\nIn a login replay attack, the attacker sends a login captured from another session. This login is valid because it is verifiable by `mojangPub`; however, without encryption, the server doesn't know that the client actually possesses `clientPriv`, and the authenticity of the client cannot be verified.\n\n## How encryption prevents the attack\n\n1. The server calculates a shared secret for encryption using ECDH of `serverPriv` and `clientPub`.\n2. It then signs a return token using `serverPriv` and sends this to the client, along with `serverPub`.\n3. The client then verifies the JWT using `serverPub`, and calculates the same shared secret as the server using `clientPriv` and `serverPub`.\n\nIf the client does not possess `clientPriv` (i.e. because it replayed a stolen login), then the session cannot proceed once encryption is enabled, since the client cannot calculate the shared secret needed to decrypt the server packets and encrypt its own packets.\n\n**Since PM3 does not implement protocol encryption, this means that ALL versions of PM3 are affected by this login stealing attack.**\n\n## How does the attacker capture a login in the first place?\nThe typical way to do this would be to trick a player into joining a server controlled by the attacker. This would allow the attacker to grab the login from the connection and store it for future use.\n\n## Are the logins valid forever?\nNo. All the JWTs have expiry dates after which they cannot be used. These expiry dates are typically 2-3 days after the token was issued by XBOX servers. PocketMine-MP 3.x does verify these expiry dates, so the use-by dates of these attacks are limited.\n\n</details>\n\n# Patches\nThis problem has been fixed in all 4.x versions by implementing Minecraft protocol encryption.\n\n~This has not yet been addressed on 3.x, but since this vulnerability is already public knowledge, the advisory has been released early to make sure people are aware of it and the mitigation steps they can take.~\n\nUpdate 2022-01-22: This has been fixed on 3.x by d28be4eaf24a890f7ef110a51181a3d806a6acca.\n\n# Workarounds\n- Use a proxy that supports encryption such as [gophertunnel](https://github.com/Sandertv/gophertunnel) between your server and players. Make sure that the server only accepts connections from the proxy. If the proxy is on the same machine as the server, you can use `server-ip=127.0.0.1` to ensure that only the proxy can create connections for you.\n\nThe following things may help mitigate the problem:\n- Verify that the `LoginPacket` `serverAddress` field is the same as the server's exposed domain name. For example: https://github.com/JustTalDevelops/AntiLoginForger\n**WARNING: THIS DOES NOT SOLVE THE ROOT ISSUE. YOU WILL REMAIN VULNERABLE UNLESS YOU UPGRADE.**\n\n# For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "pocketmine/pocketmine-mp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "4.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pmmp/PocketMine-MP/issues/4580"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pmmp/PocketMine-MP"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-01-21T21:16:04Z",
    "nvd_published_at" : null
  }
}