GHSA-xc7j-wj36-qjfr: 
PHP vulnerability analysis and mitigation

A high severity vulnerability (GHSA-xc7j-wj36-qjfr) was discovered in PocketMine-MP affecting versions below 5.11.2. The vulnerability was disclosed on March 5, 2024, and involves a server crash that occurs when a client sends a BookEditPacket with an invalid inventory slot value. The affected component is the pocketmine/pocketmine-mp Composer package (GitHub Advisory).

The vulnerability occurs when processing BookEditPacket requests with an InventorySlot value greater than 35. The issue manifests at the InGamePacketHandler.php file, where an unhandled exception is thrown by BaseInventory->getItem() when attempting to process the invalid slot value. The vulnerability has been assigned a CVSS score of 7.5 (High) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low complexity, no privileges required, and high impact on availability (GitHub Advisory).

When exploited, this vulnerability results in a complete server crash affecting all connected players. The impact is limited to availability, with no effect on confidentiality or integrity of the server data (GitHub Advisory).

The vulnerability can be exploited using Gophertunnel by sending a BookEditPacket with InventorySlot set to 36 or higher. The proof of concept command is 'serverConn.WritePacket(&packet.BookEdit{InventorySlot: 36})'. The attack requires no special privileges or user interaction, making it easily exploitable (GitHub Advisory).

The vulnerability has been patched in version 5.11.2 of PocketMine-MP. The fix was implemented in commit 47f011966092f275cc1b11f8de635e89fd9651a7, which added additional validation checks for inventory slots. Users should upgrade to version 5.11.2 or later to protect against this vulnerability (GitHub Advisory, PocketMine Commit).