Description
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 4.0.3 | 4.0.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 4.0.3 | 4.0.3 | GHSA-j5qg-w9jg-3wg3 |
References
- GitHub Security Advisory (GHSA-j5qg-w9jg-3wg3) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity third-party-advisory