Description

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-06T12:17:14.637Z",
  "pubdate": "2026-09-06T12:17:14.637Z",
  "executiveSummary": "This vulnerability involves an improper case-sensitivity handling mechanism within the operator management functionality of PocketMine-MP, specifically affecting the deop command processing.\nThe issue is classified as an access control flaw where the software fails to correctly invalidate administrative privileges due to inconsistent string comparison logic.\nAffected versions include all releases of PocketMine-MP prior to 4.0.3.\nThe primary risk implication is the persistence of unauthorized administrative privileges. An operator whose username contains uppercase characters may remain an operator despite an administrator attempting to revoke these rights via the standard deop command.\nThe vulnerability does not require complex exploitation techniques; rather, it manifests as a failure of the application to execute intended security policies. Any user with operator privileges or system access who attempts to perform a deop action will be unable to successfully remove the target if the naming convention of the operator file entry does not match the lowercase input provided by the deop function.\nSuccessful exploitation results in an escalation of privilege persistence, where a user maintains elevated access levels beyond the intended lifecycle, potentially allowing for continued abuse of administrative commands.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the removeOp function within the PocketMine-MP codebase. The function attempts to perform a case-insensitive name lookup by lowercasing the supplied input string; however, it subsequently utilizes an equality check that requires an exact match against the entries stored within the ops.txt file.\nWhen a player is granted operator status, their username is recorded in the ops.txt file as it was provided. If an operator has a username containing uppercase letters, the stored entry in ops.txt will contain those specific characters.\nWhen the deop command is executed, the removeOp function receives the target username. It processes this string by calling a lowercasing function. The subsequent logic fails to convert the stored entries in ops.txt to a uniform case before comparison. As a result, when the function iterates through the ops.txt file to identify the entry to remove, the string comparison operator evaluates the lowercase input against the mixed-case entry in the file. Due to the case-sensitive nature of the comparison, the condition evaluates to false, and the entry is never removed.\nThe attack flow proceeds as follows: 1) An administrator identifies an operator account that requires revocation. 2) The administrator executes the deop command for the target user. 3) The removeOp function executes, lowercasing the target name. 4) The function compares the lowercase name against the mixed-case name in ops.txt. 5) Because of the case mismatch, the function fails to locate the entry for deletion. 6) The administrative privileges for the target user remain active, completely bypassing the revocation intent of the administrator.\nThis flaw effectively renders the deop command useless for any operator whose stored username entry contains non-lowercase characters. The impact is a failure to enforce the Principle of Least Privilege, allowing users to retain administrative control in an unauthorized manner. The vulnerability requires no specific network exposure or external payloads, as it is a logical flaw within the internal management of the application's configuration files.\nTo rectify this, the application must ensure that the comparison logic is strictly case-insensitive, either by lowercasing all entries in the ops.txt file during the comparison process or by using case-insensitive string comparison functions when iterating through the operator list."
}