Security Risk: Command /player Can Summon Real Player in the Server
OrdosX opened this issue ยท 1 comments
What's expected
Say a Minecraft server has a player named OrdosX. When another player typed /player ordosx spawn
, the plugin should throw an error to prevent it, or summon a completely new player entity like using other names.
What's happening
The command above actually summon the real OrdosX with all its items, experience and armor. Here are what I found in my server:
- When the summoned entity is killed, it acts as if the real player is killed (like dropping items).
- If player OrdosX connects the server when the entity still exists, it will login in where the entity is.
- The player will inherit the HP, effect etc. of the entity.
Environments
Minecraft server: 1.14.4, vanilla
Fabric API: 0.4.2 build 246
Fabric loader: 0.5.2.39
Carpet mod: fabric-carpet-1.14.4-1.3.5 v200114
This is intended, that's why there is an option for operators to customize which commands are available for the players and which are not. /carpet commandPlayer can be spec'ed as 'true' - as available for all, 'false' - for none, 'ops' for operators or a number from 0-4 for custom permission level. This way you can disable the use of these for regular players possibly allowing them to run them through functions or triggers.