MrCrayfish's Furniture Mod (Legacy)

MrCrayfish's Furniture Mod (Legacy)

96M Downloads

Bad packet handling

TheAndrey opened this issue ยท 2 comments

commented

I found a lot of security issues in the mod's packet handlers that hackers can use to harm the server ๐Ÿ‘Ž

  1. MessageTakeWater - this packet is not used. Can be used to destroy any block. Must be removed.
  2. MessageEnvelope, MessagePackage, MessagePresent, MessagePresentContents - these packets use the item received from the client. A hacker can put any items in a letter/parcel/gift to get them on the server (e.g. command block). You must use the container to transfer items to the letter inventory. Packet should used to transfer only the name and other attributes.
commented

@MrCrayfish Are you going to fix it? This is important.

commented

Fixed in daec054 and f9b667b