CVE-2021-48006 Overview
CVE-2021-48006 affects PocketMine-MP versions before 4.0.3, a server software implementation for Minecraft: Bedrock Edition. The vulnerability resides in the removeOp function within src/Server.php, which fails to perform case-insensitive matching when removing operator entries from ops.txt. An administrator attempting to revoke operator privileges using the deop command cannot remove operators whose names were stored with non-lowercase letters. The affected player retains operator-level control until the entry is manually removed from ops.txt. The flaw is classified under [CWE-178: Improper Handling of Case Sensitivity].
Critical Impact
Server operators cannot be reliably revoked through the standard deop command, allowing unintended players to retain administrative privileges on PocketMine-MP servers.
Affected Products
- PocketMine-MP versions prior to 4.0.3
- Minecraft: Bedrock Edition server deployments using PocketMine-MP
- Self-hosted PocketMine-MP instances managing operator lists via ops.txt
Discovery Timeline
- 2026-09-06 - CVE-2021-48006 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2021-48006
Vulnerability Analysis
The vulnerability stems from inconsistent case handling between the operator addition and removal code paths in PocketMine-MP. When an operator is added, the name may be stored in ops.txt with mixed-case characters preserved from the input. However, the removeOp function lowercases the input name and then calls remove() on the operators collection using only the lowercase form.
This mismatch means any entry not already stored in fully lowercase form is never matched during removal. Server administrators who execute deop PlayerName receive no error, but the operator entry persists in ops.txt. The player continues to hold the ROOT_OPERATOR permission on future logins.
The issue represents a business logic flaw rather than a memory-safety condition. Exploitation requires that an operator was originally added with a name containing uppercase letters, which is common because Minecraft player names preserve case.
Root Cause
The original removeOp function normalized the lookup key but did not normalize the stored keys before comparison. The operators collection is keyed by the exact string used at insertion time, so a lowercase lookup fails against a mixed-case stored key.
Attack Vector
Exploitation is local to the server administration workflow. An attacker with existing operator privileges whose name was stored with uppercase characters cannot be demoted through normal deop commands. Any subsequent server administrator relying on deop to revoke access will believe the revocation succeeded while the target retains full operator control.
}
public function removeOp(string $name) : void{
- $this->operators->remove(strtolower($name));
+ $lowercaseName = strtolower($name);
+ foreach($this->operators->getAll() as $operatorName => $_){
+ $operatorName = (string) $operatorName;
+ if($lowercaseName === strtolower($operatorName)){
+ $this->operators->remove($operatorName);
+ }
+ }
if(($player = $this->getPlayerExact($name)) !== null){
$player->unsetBasePermission(DefaultPermissions::ROOT_OPERATOR);
Source: GitHub Commit 4d37b79. The patch iterates through all stored operator entries and lowercases each stored key before comparison, ensuring case-insensitive removal.
Detection Methods for CVE-2021-48006
Indicators of Compromise
- Entries in ops.txt containing uppercase or mixed-case characters that persist after deop commands were executed against them
- Server logs showing successful deop execution followed by continued operator-level actions by the same player
- Discrepancy between the server administrator's expected operator list and the actual contents of ops.txt
Detection Strategies
- Audit the contents of ops.txt on every PocketMine-MP host and compare against the intended operator roster
- Correlate deop command execution events in server logs with subsequent operator-privileged actions from the same player identifier
- Verify the running PocketMine-MP version against the fixed release by checking the version string emitted at server startup
Monitoring Recommendations
- Enable file integrity monitoring on ops.txt to detect unexpected retention of entries after administrative changes
- Log and review all uses of operator-only commands, particularly permission grants, plugin management, and world manipulation
- Alert on any deviation between the operator list reported by the server API and the on-disk ops.txt contents
How to Mitigate CVE-2021-48006
Immediate Actions Required
- Upgrade PocketMine-MP to version 4.0.3 or later, which contains the case-insensitive removal fix
- Manually inspect ops.txt on all servers and remove any unintended operator entries regardless of case
- Re-run intended deop operations after the upgrade to confirm the operator list reflects the desired state
Patch Information
The fix is committed in GitHub commit 4d37b79 and tracked in the PocketMine-MP Security Advisory GHSA-j5qg-w9jg-3wg3. Additional context is available in the VulnCheck Privilege Escalation Advisory.
Workarounds
- Manually edit ops.txt to remove operator entries when the deop command fails to revoke access
- Restart the server after manual edits to ensure the operators collection is reloaded from disk
- Enforce a naming convention where operator names are added in lowercase to align with the pre-patch removal logic
# Verify installed PocketMine-MP version and inspect operator list
php PocketMine-MP.phar --version
cat ops.txt
# After confirming intended operators, manually remove stale entries
sed -i '/^UnwantedOperatorName$/d' ops.txt
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.