GHSA-h79x-98r2-g6qc: 
PHP vulnerability analysis and mitigation

A moderate severity vulnerability (GHSA-h79x-98r2-g6qc) was discovered in PocketMine-MP versions 3.0.0 to 4.0.0, affecting the XBOX Live authentication system. The vulnerability, published on January 21, 2022, allows attackers to impersonate other users through login theft, particularly affecting servers that are directly accessible via the internet. The issue stems from the incomplete implementation of Minecraft Bedrock authentication protocol encryption in PocketMine-MP 3.x versions (GitHub Advisory).

The vulnerability exploits the separation between authentication and protocol encryption in the Minecraft Bedrock protocol. While the client generates a private ECC key (clientPriv) and receives a JWT containing the public key (clientPub) signed by Microsoft servers, the server only verifies the token's signature without confirming the client's possession of the private key. This enables login replay attacks where attackers can use captured login credentials that remain valid for 2-3 days after issuance. The vulnerability has a CVSS score of 4.7, with attack vector classified as Network and attack complexity as High (GitHub Advisory).

The vulnerability enables attackers to impersonate legitimate users on affected PocketMine-MP servers by capturing and replaying login credentials. This security breach primarily affects servers that are directly connected to the internet without proxy protection. The impact is limited by the JWT expiration dates, typically lasting 2-3 days after token issuance by XBOX servers (GitHub Advisory).

The vulnerability has been patched in PocketMine-MP version 4.0.0 and version 3.27.0 through the implementation of Minecraft protocol encryption. For servers unable to update immediately, recommended workarounds include using an encryption-supporting proxy like gophertunnel between the server and players, configuring the server to accept connections only from the proxy (using server-ip=127.0.0.1 for local proxies), and verifying the LoginPacket serverAddress field matches the server's exposed domain name (GitHub Advisory).