CVE-2021-39177: User impersonation vulnerability in org.geysermc:connector
Summary
CVE-2021-39177: User impersonation due to incorrect handling of the login JWT. Affects org.geysermc:connector versions < 1.4.2-SNAPSHOT. Fixed in 1.4.2-SNAPSHOT. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.geysermc:connector package is a Maven package that provides connectivity between Bedrock and Java servers. It allows Bedrock clients to connect to Java servers and vice versa. The package is widely used in Minecraft server environments. However, a vulnerability has been discovered in the package that allows an attacker to impersonate any Bedrock user by forging a LoginPacket with a manipulated JWT token.
Vulnerability Detail
The vulnerability arises from incorrect handling of the login JWT in the org.geysermc:connector package. It allows anyone who can connect to the server to create a LoginPacket with a manipulated JWT token, enabling them to impersonate any Bedrock user. This poses a risk of unauthorized access and potential misuse of user accounts. Online mode is not affected unless credentials are saved in the configuration. If credentials are saved, there is no risk of exposing email or password. The vulnerability has been assigned a CVSS score of 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.2-SNAPSHOT
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, the following workarounds can be implemented:
- Use online mode and avoid saving credentials in the Geyser configuration.
- Implement an additional authentication method on the Java server to enhance security.
Conclusion
The org.geysermc:connector package is vulnerable to a user impersonation vulnerability due to incorrect handling of the login JWT. It is crucial to update the package to the latest version (1.4.2-SNAPSHOT or later) to mitigate the risk. If immediate updating is not possible, follow the provided workarounds and additional security measures. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.geysermc:connector →
FAQ
Anyone using the org.geysermc:connector package in their Minecraft server environment is potentially affected by this vulnerability.
The vulnerability allows an attacker to impersonate any Bedrock user, potentially leading to unauthorized access and misuse of user accounts.
Online mode is not affected unless credentials are saved in the Geyser configuration. If credentials are saved, there is no risk of exposing email or password.
To fix the vulnerability, update the org.geysermc:connector package to version 1.4.2-SNAPSHOT or later.
If updating the package is not immediately possible, use online mode and avoid saving credentials in the Geyser configuration. Additionally, implement an additional authentication method on the Java server.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
