search

DevotedMC / NameLayer

A Citadel reinforcement group manager. Allows the creation of groups in Minecraft. Built for Spigot 1.14.4
https://build.devotedmc.com/job/Namelayer-master/
BSD 3-Clause "New" or "Revised" License
3 stars 8 forks source link

Critical Security Vulnerability #19

Closed ProgrammerDan closed 7 years ago

ProgrammerDan commented 7 years ago

https://github.com/DevotedMC/NameLayer/blob/master/namelayer-spigot/src/main/java/vg/civcraft/mc/namelayer/command/commands/ListGroups.java#L45

On first join, a player with the name of an existing player, retains that player's name. It's only changed on rejoin.

Consequently, this method allows that spoofing user, for a single session, to gain access to that player's groups.

ProgrammerDan commented 7 years ago

Inverted here: https://github.com/DevotedMC/NameLayer/blob/master/namelayer-spigot/src/main/java/vg/civcraft/mc/namelayer/listeners/AssociationListener.java#L50

Don't just return, set the name, then return. Bad code.