CVE-2023-7332: 
PHP vulnerability analysis and mitigation

CVE-2023-7332 is an improper input validation vulnerability in PocketMine-MP, a custom Minecraft: Bedrock Edition server software, affecting all versions prior to 4.18.1. The flaw exists in inventory transaction handling and allows a remote authenticated attacker to request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service. The vulnerability was introduced in version 4.18.0 during a complete revamp of network inventory handling, and was patched on March 27, 2023 with the release of 4.18.1. It carries a CVSS v4.0 base score of 7.1 (High) and a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input). When PocketMine-MP 4.18.0 introduced the ItemStackRequest network protocol, the handleNormalTransaction() function in src/network/mcpe/handler/InGamePacketHandler.php failed to verify that the requested drop count ($droppedCount) did not exceed the actual item count available in the source inventory slot ($sourceSlotItem->getCount()). The fix, applied in commit 5897476, adds a simple bounds check that returns false if the dropped count exceeds the available count, preventing the crash (GitHub Commit, GitHub Advisory). Exploitation requires only a valid player session (low privileges) and no user interaction, and is achievable over the network with low attack complexity.

Successful exploitation results in a complete server crash, causing a denial of service for all players connected to the affected PocketMine-MP instance. The vulnerability has no confidentiality or integrity impact — data is not exposed or modified — but availability is fully compromised for the duration of the outage. The advisory notes the vulnerability is believed to have been exploited in the wild, meaning game server operators may have experienced unexpected crashes attributable to this flaw (GitHub Advisory).

The vulnerability is believed to have been exploited in the wild prior to the patch release, according to the official security advisory (GitHub Advisory). Exploitation requires only a valid player session (i.e., a legitimate game account connected to the server), making it accessible to any authenticated player. No public exploit code or attribution to specific threat actors has been identified. The EPSS score is approximately 0.22%, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain a valid player session: Connect to a target PocketMine-MP server running version 4.18.0 using a legitimate Minecraft: Bedrock Edition client or a modified client capable of crafting custom packets.
2. Identify a hotbar slot: Ensure the player has an item in their hotbar with a known, limited quantity (e.g., a single item or a small stack).
3. Craft a malicious InventoryTransactionPacket: Using a modified client or packet manipulation tool, construct an InventoryTransactionPacket (drop item transaction) that specifies a droppedCount value exceeding the actual item count available in the targeted hotbar slot.
4. Send the packet to the server: Transmit the crafted packet to the server. The vulnerable handleNormalTransaction() function in InGamePacketHandler.php does not validate that the requested drop count is within bounds.
5. Trigger server crash: The server attempts to process the invalid transaction, encounters an unhandled error condition, and crashes — disconnecting all players and causing a denial of service (GitHub Advisory, GitHub Commit).

• Logs: Unexpected server crash logs in PocketMine-MP's crash dump files, particularly referencing InGamePacketHandler or inventory transaction processing; RakLib session logs naming the player session active at the time of crash (added in 4.18.1).
• Process: Sudden termination of the PocketMine-MP server process without a graceful shutdown, potentially recurring if the attacker reconnects and repeats the action.
• Network: Repeated InventoryTransactionPacket (drop item type) packets from a single player session with anomalously high item count values exceeding normal inventory stack sizes.

The primary remediation is to upgrade PocketMine-MP to version 4.18.1 or later, which was released on March 27, 2023 and includes the fix in commit 5897476 (GitHub Changelog). As a temporary workaround for operators unable to upgrade immediately, the advisory recommends handling InventoryTransactionPacket in a DataPacketReceiveEvent plugin and manually verifying that the dropped item count does not exceed the available item count; however, this approach is noted as complex and not recommended (GitHub Advisory). Restricting server access to trusted players only can reduce exposure until patching is possible.