Description

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T13:17:23.463Z",
  "pubdate": "2026-09-07T13:17:23.463Z",
  "executiveSummary": "PocketMine-MP versions prior to 4.0.6 are susceptible to a Denial of Service (DoS) vulnerability arising from improper input validation of network packet data. The flaw resides in the handling of facing values within PlayerActionPacket and UseItemTransactionData structures.\nA remote authenticated attacker can exploit this vulnerability by injecting specially crafted packets containing out-of-range or malformed integer values into the server's network stream. Because the server does not perform adequate bounds checking or sanitization of these values before processing, the resulting logic error triggers an unhandled exception or crash.\nThe successful exploitation of this vulnerability results in an immediate server process termination, leading to a sustained Denial of Service. This issue affects any instance of PocketMine-MP running a version below 4.0.6. There are no special privilege requirements other than the ability to establish an authenticated connection to the game server. To mitigate this risk, administrators must ensure their server software is updated to at least version 4.0.6, where the necessary validation logic was introduced to reject malformed packets.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the server's network packet processing layer to validate the integrity of specific integer fields, specifically the 'facing' metadata. In the Minecraft Bedrock networking protocol (RakNet/MCPE), the 'facing' field defines the orientation of a block interaction, typically represented as an integer constant corresponding to a valid direction (e.g., UP, DOWN, NORTH, SOUTH, EAST, WEST).\nThe vulnerability manifests within two primary packet structures: PlayerActionPacket, specifically during the handling of 'START_BREAK' and 'CRACK_BREAK' actions, and UseItemTransactionData, which is encapsulated within the InventoryTransactionPacket. When these packets are received, the server attempts to utilize the 'facing' value directly within game logic to perform block interaction calculations, such as checking for block collision or identifying the face of a block to target.\nThe exploitation process follows a specific attack flow: First, an attacker establishes a valid session with the target PocketMine-MP server. Once authenticated, the attacker utilizes a modified client or a packet-crafting tool (e.g., an interceptor proxy) to generate arbitrary PlayerActionPacket or InventoryTransactionPacket instances. Within these packets, the attacker modifies the 'facing' field to contain an value outside the expected enumeration range—such as a large positive integer, a negative value, or an undefined index.\nUpon receipt, the server’s packet parser deserializes these malicious packets. Because the vulnerable code paths do not perform range validation (e.g., checking if the value exists within a set of allowed indices or using a strict boundary check), the invalid value is passed into the server's internal engine. This triggers an exception—likely an 'Undefined offset' or 'Invalid argument'—when the engine attempts to perform lookups or array indexing based on the malicious facing value. If this exception remains uncaught at the top-level packet handling loop, the server process terminates instantly.\nThe impact is a complete service interruption. Since the crash occurs during the processing of a single packet, the server is forced into a persistent DoS state. Any authenticated client can repeat the process indefinitely, preventing legitimate players from maintaining a connection to the environment. The issue is purely a result of insecure deserialization/validation logic within the PocketMine-MP codebase and is resolved by enforcing strict bounds checking on the 'facing' integer constants prior to further processing."
}