{"id":"GHSA-7wrv-6h42-w54f","aliases":["CVE-2023-54392"],"title":"PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket","description":"### Summary\nA player sending a packet can cause the server to crash by providing incorrect sign data in NBT in `BlockActorDataPacket`.\n\n### Details\nThis vulnerability was discovered using the `BlockActorDataPacket`, but other packets may also be affected. The player would seem to just need to send an NBT with an incorrect type to throw this error.\n\n```\n[Server thread/CRITICAL]: pocketmine\\nbt\\UnexpectedTagTypeException: \"Expected a tag of type pocketmine\\nbt\\tag\\CompoundTag, got pocketmine\\nbt\\tag\\ByteTag\" (EXCEPTION) in \"pmsrc/vendor/pocketmine/nbt/src/tag/CompoundTag\" at line 107\n--- Stack trace ---\n  #0 pmsrc/src/network/mcpe/handler/InGamePacketHandler(751): pocketmine\\nbt\\tag\\CompoundTag->getCompoundTag(string[9] FrontText)\n  #1 pmsrc/vendor/pocketmine/bedrock-protocol/src/BlockActorDataPacket(50): pocketmine\\network\\mcpe\\handler\\InGamePacketHandler->handleBlockActorData(object pocketmine\\network\\mcpe\\protocol\\BlockActorDataPacket#220241)\n  #2 pmsrc/src/network/mcpe/NetworkSession(433): pocketmine\\network\\mcpe\\protocol\\BlockActorDataPacket->handle(object pocketmine\\network\\mcpe\\handler\\InGamePacketHandler#190572)\n```\n\n### PoC\nUse a bot or proxy to send a packet when editing a sign. This packet should contain an NBT with incorrect types but correct architecture.\n\n### Impact\nThis makes it possible to shutdown a server for someone who knows how to operate it. As this was discovered in 4.22.1, everyone with at least this version is affected.\n\n### Patches\nThis bug was fixed by 0c250a2ef09627b48aa52302f6cc7e1f2afb70ea in the 4.22.3 and 5.2.1 releases.\n\n### Workarounds\nA plugin may be able to handle `DataPacketReceiveEvent` for `BlockActorDataPacket`, and verify that the `FrontText` tag is a `TAG_Compound`.","severity":"high","score":7.5,"published":"2023-07-14T21:50:42.000Z","modified":"2026-09-10T03:56:07.870Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","ranges":[{"events":[{"introduced":"4.20.0"},{"fixed":"4.22.3"}],"type":"ECOSYSTEM"}],"versions":["4.20.0","4.20.1","4.20.2","4.20.3","4.20.4","4.20.5","4.21.0","4.21.1","4.22.0","4.22.1","4.22.2"],"fixed":["4.22.3"]},{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","ranges":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.2.1"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.1.3","5.2.0"],"fixed":["5.2.1"]}],"references":["https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f","https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea","https://github.com/pmmp/PocketMine-MP"],"sources":[{"name":"OSV","id":"GHSA-7wrv-6h42-w54f","modified":"2026-09-10T03:56:07.870772994Z","url":"https://osv.dev/vulnerability/GHSA-7wrv-6h42-w54f"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}]}