PocketMine-MP Privilege Escalation via Case-Sensitive ops.txt Handling

Executive Summary

CVE-2021-48006 is a case-sensitivity flaw in PocketMine-MP before version 4.0.3. The removeOp function lowercases input names but only removes exact matches from ops.txt. If an operator's name is stored with uppercase letters, the deop command fails to revoke privileges, leaving the player as an operator until manual removal from ops.txt.

Useful 0 Not Useful 0

Detection Guidance

Check the ops.txt file in your PocketMine-MP server directory for operator names with uppercase letters. Use commands like 'grep -i [username] ops.txt' to search for case variations. If a player cannot be deopped via the deop command but exists in ops.txt with uppercase letters, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows players with uppercase letters in their names to retain admin privileges indefinitely. Even after using the deop command, their operator status remains, requiring manual editing of ops.txt to remove them. This could lead to unauthorized administrative access in the server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a privilege escalation issue within a game server software. It does not involve unauthorized access to personal or sensitive data, nor does it impact data confidentiality, integrity, or availability beyond operator privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Update PocketMine-MP to version 4.0.3 or later to patch the issue. If updating is not possible, manually edit the ops.txt file to ensure all operator names are in lowercase. Remove any entries with uppercase letters to prevent privilege escalation.

Useful 0 Not Useful 0