GHSA-8jq6-w5cg-wm45: 
PHP vulnerability analysis and mitigation

A high-severity vulnerability was discovered in PocketMine-MP versions prior to 3.15.4, identified as GHSA-8jq6-w5cg-wm45. The vulnerability involves exploitable inventory component chaining that could be triggered through specially crafted InventoryTransactionPackets. This security issue was published on November 10, 2020, and affects the composer package pocketmine/pocketmine-mp (GitHub Advisory).

The vulnerability exists in the InventoryTransaction->findResultItem() function, where the code attempts to compact conflicting InventoryActions within the same InventoryTransaction by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening operation became exponential. The issue was classified as CWE-400 and received a High severity rating (GitHub Advisory).

When exploited, this vulnerability causes the server to experience apparent freezing due to abnormally long execution times of the affected code. The issue was actively exploited in the wild by attackers to perform denial of service attacks against servers (GitHub Advisory).

The vulnerability was confirmed to be actively exploited in the wild through specially crafted InventoryTransactionPackets sent by malicious clients (GitHub Advisory).

The primary mitigation is to upgrade to PocketMine-MP version 3.15.4 or newer, which contains the fix. The fix involves implementing checks to bail when ambiguities are detected. No practical workarounds are available except for backporting the fix or implementing checks in a plugin listening to DataPacketReceiveEvent (GitHub Advisory).