Skip to content
Fencer Intel
critical 10.0

GHSA-3qpm-h9ch-px3c json

Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library

published 4y ago modified last yr.

cvss
10.0
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser. It's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).

### Impact Malicious client code could be used to send messages and cause remote code execution on the server.

### Patches PowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`. All versions prior to `1.5.2.1` are affected and are not patched.

### Workarounds If you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.

### References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/advisories/GHSA-p6xc-xr62-6r2g

### For more information If you have any questions or comments about this advisory: * Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)

Patch / fix

  • maven org.powernukkit:powernukkit 1.5.2.1

Is GHSA-3qpm-h9ch-px3c in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.powernukkit:powernukkit
<1.5.2.1
1.5.2.1

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.