Description

PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T13:17:23.317Z",
  "pubdate": "2026-09-07T13:17:23.317Z",
  "executiveSummary": "The vulnerability identified in PocketMine-MP involves an unhandled exception triggered by the processing of malformed JSON payloads within the ModalFormResponsePacket handler.\nThis flaw allows a remote, unauthenticated attacker to induce a Denial-of-Service (DoS) condition by forcing the server process to terminate due to an uncaught InvalidArgumentException.\nThe impact is significant, as it leads to an immediate crash of the server instance, disrupting availability for all connected clients.\nAffected versions include all releases of PocketMine-MP prior to 4.0.7.\nThe attack requires no special privileges, as the malicious packet can be injected during the standard network communication process between the client and the server.\nRisk implications center on the lack of input validation for form-related packets, which facilitates unauthorized service disruption.",
  "technicalDetails": "The vulnerability resides within the ModalFormResponsePacket handler, which is responsible for parsing and deserializing form responses transmitted from the client to the server.\nThe root cause is an insufficient validation routine when handling JSON-formatted data contained within these packets. When a client sends a payload that does not conform to expected JSON syntax, the underlying deserialization logic fails.\nIn affected versions of PocketMine-MP, the server-side logic fails to implement a robust exception handling mechanism (e.g., a try-catch block) around the JSON decoding process. Upon encountering invalid input, the library or internal handler throws an InvalidArgumentException.\nBecause the server process does not catch this exception, the runtime environment propagates the error, resulting in an immediate and fatal termination of the server thread or process.\nThe attack flow proceeds as follows: An attacker establishes a network connection to the PocketMine-MP server. The attacker then constructs a malicious ModalFormResponsePacket containing a malformed JSON string in place of the expected form response data. This packet is transmitted over the network protocol to the server.\nUpon receipt, the server’s packet handler invokes the vulnerable function. The JSON decoding routine detects the structural invalidity of the packet payload and triggers an InvalidArgumentException. Due to the absence of appropriate error handling, the process crashes, effectively denying service to all legitimate users.\nThis vulnerability is particularly critical as it does not require the attacker to possess authenticated sessions or specific administrative privileges; the packet is processed during the routine handling of client inputs. Exploitation is trivial, requiring only a basic understanding of the packet structure to successfully crash the server process repeatedly.\nPost-exploitation impact is limited to the availability of the service. No Remote Code Execution (RCE) or unauthorized data access is implied by this specific exception handling flaw, though it renders the server unresponsive until manual intervention or a service watchdog restarts the instance."
}