CVE-2021-37632 (GCVE-0-2021-37632)
Vulnerability from cvelistv5 – Published: 2021-08-05 20:15 – Updated: 2024-08-04 01:23
VLAI
Title
Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket
Summary
SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642's Config Lib, servers will send a packet to clients with the server's config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642's Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher.
Severity
8.1 (High)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/SuperMartijn642/SuperMartijn64… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SuperMartijn642 | SuperMartijn642sConfigLib |
Affected:
>= 1.0.4, < 1.0.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:23:01.336Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SuperMartijn642sConfigLib",
"vendor": "SuperMartijn642",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.4, \u003c 1.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperMartijn642\u0027s Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642\u0027s Config Lib, servers will send a packet to clients with the server\u0027s config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642\u0027s Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-05T20:15:09.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6"
}
],
"source": {
"advisory": "GHSA-f4r5-w453-2jx6",
"discovery": "UNKNOWN"
},
"title": "Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-37632",
"STATE": "PUBLIC",
"TITLE": "Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SuperMartijn642sConfigLib",
"version": {
"version_data": [
{
"version_value": "\u003e= 1.0.4, \u003c 1.0.8"
}
]
}
}
]
},
"vendor_name": "SuperMartijn642"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SuperMartijn642\u0027s Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642\u0027s Config Lib, servers will send a packet to clients with the server\u0027s config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642\u0027s Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502: Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6",
"refsource": "CONFIRM",
"url": "https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6"
}
]
},
"source": {
"advisory": "GHSA-f4r5-w453-2jx6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-37632",
"datePublished": "2021-08-05T20:15:09.000Z",
"dateReserved": "2021-07-29T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:23:01.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-37632",
"date": "2026-06-06",
"epss": "0.01856",
"percentile": "0.83411"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:config_lib_project:config_lib:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.0.4\", \"versionEndExcluding\": \"1.0.9\", \"matchCriteriaId\": \"418BE337-88A4-42B1-8D51-16D3E1815B58\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"SuperMartijn642\u0027s Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642\u0027s Config Lib, servers will send a packet to clients with the server\u0027s config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642\u0027s Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher.\"}, {\"lang\": \"es\", \"value\": \"SuperMartijn642\u0027s Config Lib es una biblioteca usada por varios mods para el juego Minecraft. Las versiones de SuperMartijn642\u0027s Config Lib entre 1.0.4 y 1.0.8, est\\u00e1n afectadas por una vulnerabilidad y pueden ser explotadas tanto en servidores como en clientes. Usando Config Lib de SuperMartijn642, los servidores enviar\\u00e1n un paquete a clientes con los valores de configuraci\\u00f3n del servidor. Para leer los valores \\\"enum\\\" de los datos del paquete, es usado \\\"ObjectInputStream#readObject\\\". \\\"ObjectInputStream#readObject\\\" instanciar\\u00e1 una clase basada en los datos de entrada. Como los datos del paquete no se comprueban antes de llamar a \\\"ObjectInputStream#readObject\\\", un atacante puede instanciar cualquier clase mediante el env\\u00edo de un paquete malicioso. Si se encuentra una clase adecuada, la vulnerabilidad puede conllevar a una serie de explotaciones, incluyendo una ejecuci\\u00f3n de c\\u00f3digo remota. Aunque el paquete vulnerable normalmente s\\u00f3lo se env\\u00eda del servidor al cliente, te\\u00f3ricamente tambi\\u00e9n puede enviarse del cliente al servidor. Esto significa que tanto los clientes como los servidores que ejecutan el Config Lib de SuperMartijn642 entre 1.0.4 y 1.0.8 son vulnerables. La vulnerabilidad ha sido parcheada en la Config lib 1.0.9 de SuperMartijn642. Tanto los jugadores como los propietarios de servidores deben actualizar a la versi\\u00f3n 1.0.9 o superior\"}]",
"id": "CVE-2021-37632",
"lastModified": "2024-11-21T06:15:33.953",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-08-05T21:15:12.687",
"references": "[{\"url\": \"https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-37632\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-08-05T21:15:12.687\",\"lastModified\":\"2024-11-21T06:15:33.953\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SuperMartijn642\u0027s Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642\u0027s Config Lib, servers will send a packet to clients with the server\u0027s config values. In order to read `enum` values from the packet data, `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since, the packet data is not validated before `ObjectInputStream#readObject` is called, an attacker can instantiate any class by sending a malicious packet. If a suitable class is found, the vulnerability can lead to a number of exploits, including remote code execution. Although the vulnerable packet is typically only send from server to client, it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642\u0027s Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642\u0027s Config lib 1.0.9. Both, players and server owners, should update to 1.0.9 or higher.\"},{\"lang\":\"es\",\"value\":\"SuperMartijn642\u0027s Config Lib es una biblioteca usada por varios mods para el juego Minecraft. Las versiones de SuperMartijn642\u0027s Config Lib entre 1.0.4 y 1.0.8, est\u00e1n afectadas por una vulnerabilidad y pueden ser explotadas tanto en servidores como en clientes. Usando Config Lib de SuperMartijn642, los servidores enviar\u00e1n un paquete a clientes con los valores de configuraci\u00f3n del servidor. Para leer los valores \\\"enum\\\" de los datos del paquete, es usado \\\"ObjectInputStream#readObject\\\". \\\"ObjectInputStream#readObject\\\" instanciar\u00e1 una clase basada en los datos de entrada. Como los datos del paquete no se comprueban antes de llamar a \\\"ObjectInputStream#readObject\\\", un atacante puede instanciar cualquier clase mediante el env\u00edo de un paquete malicioso. Si se encuentra una clase adecuada, la vulnerabilidad puede conllevar a una serie de explotaciones, incluyendo una ejecuci\u00f3n de c\u00f3digo remota. Aunque el paquete vulnerable normalmente s\u00f3lo se env\u00eda del servidor al cliente, te\u00f3ricamente tambi\u00e9n puede enviarse del cliente al servidor. Esto significa que tanto los clientes como los servidores que ejecutan el Config Lib de SuperMartijn642 entre 1.0.4 y 1.0.8 son vulnerables. La vulnerabilidad ha sido parcheada en la Config lib 1.0.9 de SuperMartijn642. Tanto los jugadores como los propietarios de servidores deben actualizar a la versi\u00f3n 1.0.9 o superior\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:config_lib_project:config_lib:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.4\",\"versionEndExcluding\":\"1.0.9\",\"matchCriteriaId\":\"418BE337-88A4-42B1-8D51-16D3E1815B58\"}]}]}],\"references\":[{\"url\":\"https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/SuperMartijn642/SuperMartijn642sConfigLib/security/advisories/GHSA-f4r5-w453-2jx6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…