A new exploit has been spotted in the wild, enabling complete remote code execution (RCE) on clients and servers running popular Minecraft mods on 1.7.10/1.12.2 Forge.

It's crucial to understand that this vulnerability doesn't stem from Forge itself but mods that employ unsafe deserialization code.

The Vulnerable Mods

Several mods have been pinpointed as susceptible to the BleedingPipe exploit. These include EnderCore, LogisticsPipes, BDLib, Smart Moving 1.12, Brazier, DankNull, and Gadomancy. It's imperative for both players and server administrators to either update these mods or remove them entirely to reduce the risk.

Tracing the Origins

The Java community has been aware of this kind of vulnerability, often termed as a deserialization attack or gadget chain, for quite some time. The first indications of this exploit within the Minecraft modding community can be traced back to March 2022, when a vulnerability in ObjectInputStream was hinted at on BDLib’s GitHub. The issue remained dormant until it resurfaced in July 2023, leading to widespread awareness and subsequent patching efforts.

The Exploitation Surge

Post the initial discovery, it was revealed that a malicious actor had scanned all Minecraft servers on the IPv4 address space to exploit vulnerable servers on a large scale. The exact contents of the exploit and its potential impact on other clients remain unknown.

Protective Measures

The ambiguity surrounding the exploit's payload makes detection a challenging task. However, server admins are advised to search for suspicious files and run malware detection tools like jSus or jNeedle on all installed mods. Conversely, players should conduct antivirus scans and check for suspicious files in their .minecraft directory.

Mitigating the Threat

Updating EnderIO or LogisticsPipes to the latest CurseForge versions is recommended to mitigate the risk. For BDLib users, a migration to the GT New Horizons fork is suggested. The PipeBlocker mod can also be installed on forge servers and clients for general mitigation.

A Technical Examination

The root cause of the BleedingPipe exploits lies in the use of ObjectInputStream for networking code in the affected mods. This sends packets with malicious serialization, enabling any code to be run on the server, which can then infect all clients.

// Hypothetical example of vulnerable code
public class VulnerableClass {
    public void executeCommand(String command) {
        try {
            Runtime.getRuntime().exec(command);
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

In the example above, the executeCommand method is vulnerable to RCE because it executes any command it receives without any validation or sanitization. This is a simplified example; actual vulnerabilities can be much more complex and harder to spot.

// Hypothetical example of a secure code
public class SecureClass {
    public void executeCommand(String command) {
        if (isValidCommand(command)) {
            try {
                Runtime.getRuntime().exec(command);
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }

    private boolean isValidCommand(String command) {
        // Implement validation logic here
        return true;
    }
}