VDB
Sign up
MEDIUM6.5

GHSA-p62j-hrxm-xcxf

Book page text, count, and author/title length is not limited in PocketMine-MP

Quick fix

GHSA-p62j-hrxm-xcxf — pocketmine/pocketmine-mp: upgrade to the fixed version with the command below.

composer require pocketmine/pocketmine-mp:^3.26.5

Details

### Impact Players can fill book pages with as many characters as they like; the server does not check this. In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems: - Oversized NBT on the wire costing excess bandwidth for server and client - Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific) - Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

### Patches The bug has been fixed in 3.26.5 and 4.0.5.

### Workarounds Ban writable books, or use a plugin to cancel `PlayerEditBookEvent` to cancel the event if `strlen(text) > 1024 || mb_strlen(text) > 256`.

### For more information If you have any questions or comments about this advisory: * Email us at [team@pmmp.io](mailto:team@pmmp.io)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/pocketmine/pocketmine-mp
Introduced in: 0Fixed in: 3.26.5
Fixcomposer require pocketmine/pocketmine-mp:^3.26.5
Packagist/pocketmine/pocketmine-mp
Introduced in: 4.0.0Fixed in: 4.0.5
Fixcomposer require pocketmine/pocketmine-mp:^4.0.5

References