Attacker may construct a nbt update packet to update Server data

DavidGoldman / NBTEdit

In-Game NBTEdit for Minecraft

GNU General Public License v3.0

28 stars 43 forks source link

Attacker may construct a nbt update packet to update Server data #4

Open q178666380 opened 7 years ago

q178666380 commented 7 years ago

Attacker can modify code,and open a edit gui in client side,then send edit result to server,but server side not check who send NBT update packet, just invoke update methd Advice: add permisson check to all packet in handleServerSide method

EmanYm commented 7 years ago

You might consider switching to the more recent fork of this plugin. NBTEdit has switched developers twice since David did this. https://github.com/Jay113355/NBTEdit/releases/

Icetebe commented 4 years ago

@q178666380 HELLO