search

Ajneb97 / EasyCommandBlocker

MIT License
6 stars 4 forks source link

⚠️ Potential ForceOP exploit #18

Closed ProJakob closed 1 week ago

ProJakob commented 1 week ago

Sending a plugin message to the channel ecb:channel with the UTF-String contents ActionsSubChannel and console_command: op %player% will result in the plugin running the untrusted command from the packet. This needs bungeecord to be enabled in the spigot.yml file.

Potential fix: Simply blocking any messages coming on that channel from a client connection via the proxy (Velocity, Bungeecord) would resolve this issue.

Ajneb97 commented 1 week ago

This is already being fixed and tested.

Tjorven-Liebe commented 1 week ago

Maybe put this into your consideration PR @Ajneb97

AzSumPesho commented 1 week ago

The exploit was being abused by me and my friend for a few weeks now so it isn't "potential" but still nice that you're warning people.