GHSA-xc7j-wj36-qjfr

    Dashboard / Vulnerabilities / GHSA-xc7j-wj36-qjfr

    GHSA-xc7j-wj36-qjfr

    Published: 6 Mar 2024Last Modified: 10 Sept 2026

    Summary: PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid

    Details: ### Summary If a client sends a BookEditPacket with InventorySlot greater than 35, the server will crash due to an unhandled exception thrown by `BaseInventory->getItem()`. ### Details Crashes at https://github.com/pmmp/PocketMine-MP/blob/b744e09352a714d89220719ab6948a010ac636fc/src/network/mcpe/handler/InGamePacketHandler.php#L873 ### PoC Using Gophertunnel, use `serverConn.WritePacket(&packet.BookEdit{InventorySlot: 36})` ### Impact Server crash, all servers ### Patched versions This issue was fixed by 47f011966092f275cc1b11f8de635e89fd9651a7, and the fix was released in 5.11.2.

    References: https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xc7j-wj36-qjfr, https://github.com/pmmp/PocketMine-MP/commit/47f011966092f275cc1b11f8de635e89fd9651a7, https://github.com/pmmp/PocketMine-MP, https://github.com/pmmp/PocketMine-MP/blob/b744e09352a714d89220719ab6948a010ac636fc/src/network/mcpe/handler/InGamePacketHandler.php#L873

    Affected packages

    Package

    Name: pocketmine/pocketmine-mp

    Purl: pkg:composer/pocketmine/pocketmine-mp

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.11.2

    Affected versions

    3.0.0
    3.0.1
    3.0.10
    3.0.11
    3.0.12
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.0.6
    3.0.7
    3.0.8
    3.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-xc7j-wj36-qjfr | CVE-DB