CVE-2021-39177 User impersonation due to incorrect handling of the login JWT
Attackers can impersonate any user by forging JWT tokens in login packets, allowing unauthorized access to the Minecraft bridge server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39177?
CVE-2021-39177 is a high-severity authentication bypass vulnerability in GeyserMC Geyser, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.
Weakness: CWE-287
Which versions are affected by CVE-2021-39177?
2 open source packages ship an affected version, including org.geysermc:connector. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.geysermc:connector Maven | All versions | 1.4.2-SNAPSHOT |
org.geysermc:connector Maven | All versions | 1.4.2-SNAPSHOT |
Products include Geysermc Geyser.
How do I fix CVE-2021-39177?
Upgrade org.geysermc:connector to 1.4.2-SNAPSHOT or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-39177 being exploited?
There is no known exploitation of CVE-2021-39177 in the wild and no public exploit code.
Other vulnerabilities in GeyserMC Geyser
Sources
Also known as GHSA-h77f-xxx7-4858.