CVE-2023-54393: PocketMine-MP JSON Parsing DoS Vulnerability

CVE-2023-54393 Overview

CVE-2023-54393 is a denial of service vulnerability affecting PocketMine-MP versions before 4.20.5. The flaw resides in the handling of LoginPacket JSON parsing, where the JsonMapper dependency fails to properly validate input structures. An unauthenticated remote attacker can send a malformed JSON payload inside a LoginPacket to crash the server process. The weakness is categorized as [CWE-20] Improper Input Validation. Because PocketMine-MP servers accept connections from arbitrary Minecraft Bedrock clients on the network, exploitation requires no privileges or user interaction.

Critical Impact
Unauthenticated remote attackers can crash PocketMine-MP servers by sending a single crafted LoginPacket, disrupting game service availability for all connected players.

Affected Products

PocketMine-MP versions prior to 4.20.5
netresearch/jsonmapper dependency versions ^4.0 (as bundled by affected PocketMine-MP releases)
Minecraft Bedrock server deployments running vulnerable PocketMine-MP builds

Discovery Timeline

2026-09-09 - CVE-2023-54393 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2023-54393

Vulnerability Analysis

PocketMine-MP is a server software implementation for the Minecraft Bedrock Edition protocol written in PHP. When a client connects, it transmits a LoginPacket containing JSON-encoded identity and profile data. The server deserializes this payload using the netresearch/jsonmapper library, which maps JSON fields onto typed PHP properties. The vulnerable versions of JsonMapper do not correctly handle a case where a JSON array is supplied for a property that is declared as a scalar string. The upstream issue is tracked as cweiske/JsonMapper#210. Instead of gracefully rejecting the type mismatch, the library raises an unhandled error condition inside PocketMine-MP's packet processing pipeline, terminating the server process.

Root Cause

The root cause is improper input validation inside the third-party netresearch/jsonmapper dependency. When a JSON array is encountered where a string-typed property is expected, JsonMapper produces an error state that PocketMine-MP does not catch prior to executing session logic. Because the parsing occurs before any authentication or protocol-level trust decision, any attacker capable of reaching the server's UDP listener can trigger the fault.

Attack Vector

Exploitation is remote and network-based. The attacker constructs a Bedrock LoginPacket containing a chain or extraData JSON field where a property expected to be a scalar string is instead supplied as an array (for example, "DisplayName": ["a","b"]). Sending this packet during the connection handshake crashes the PHP process serving the game world, disconnecting every player and interrupting service until the operator restarts the daemon. Repeat delivery sustains an outage.

text

// Patch: composer.json - switch JsonMapper to a fork that fixes the type-mismatch handling
       "composer-runtime-api": "^2.0",
       "adhocore/json-comment": "^1.1",
       "fgrosse/phpasn1": "^2.3",
-      "netresearch/jsonmapper": "^4.0",
+      "netresearch/jsonmapper": "dev-array-in-string-property-error as 4.2.0",
       "pocketmine/bedrock-block-upgrade-schema": "~2.1.0+bedrock-1.19.80",
       "pocketmine/bedrock-data": "~2.2.0+bedrock-1.19.80",
       "pocketmine/bedrock-item-upgrade-schema": "~1.2.0+bedrock-1.19.80",

Source: GitHub Commit 09668a3

Detection Methods for CVE-2023-54393

Indicators of Compromise

Unexpected termination of the PocketMine-MP PHP process shortly after a client connection attempt, without a clean shutdown message in the server log.
Server log entries referencing JsonMapper exceptions or type-mismatch errors during LoginPacket handling.
Bursts of short-lived Bedrock client connections from a single source IP followed by server restarts.

Detection Strategies

Monitor the server process lifecycle and alert on repeated unplanned exits of the PocketMine-MP daemon.
Inspect application logs for stack traces originating in NetworkSession or the LoginPacket decode path referencing netresearch/jsonmapper.
Correlate crash timestamps with inbound UDP connection metadata to identify probable attacker source addresses.

Monitoring Recommendations

Forward PocketMine-MP application logs and process supervisor events to a centralized logging pipeline for retention and search.
Enable rate limiting or connection tracking on the Bedrock UDP port to surface anomalous connection volumes.
Track version metadata across all PocketMine-MP hosts and alert when any node runs a release earlier than 4.20.5.

How to Mitigate CVE-2023-54393

Immediate Actions Required

Upgrade all PocketMine-MP instances to version 4.20.5 or later without delay.
Restrict inbound access to the Bedrock server port (default UDP 19132) to trusted networks or an allow-list of player IPs where feasible.
Configure the server process under a supervisor (systemd, supervisord) that restarts on crash to reduce downtime while patching is scheduled.

Patch Information

The fix is delivered by pinning PocketMine-MP's composer.json to a patched fork of netresearch/jsonmapper (dev-array-in-string-property-error as 4.2.0) that correctly handles arrays supplied where scalar string properties are expected. See the upstream commits 09668a3 and a31902a, the GHSA-pqp3-8rrw-g8vm advisory, and the VulnCheck advisory.

Workarounds

If immediate patching is not possible, place the server behind a proxy or firewall that blocks untrusted source IPs from reaching the Bedrock listener.
Temporarily require a whitelist of known player accounts and drop connections from unknown sources at the network edge.
Run the PocketMine-MP process under a supervisor with automatic restart to limit outage duration triggered by crash attempts.

bash

# Update PocketMine-MP to the patched release using Composer
cd /opt/pocketmine-mp
composer require pocketmine/pocketmine-mp:^4.20.5 --update-with-all-dependencies
composer update netresearch/jsonmapper

# Verify the installed version
php PocketMine-MP.phar --version