CVE-2025-61680: Minecraft RCON Terminal Plaintext Storage

CVE-2025-61680 Overview

CVE-2025-61680 affects the Minecraft RCON Terminal extension for Visual Studio Code. The extension stores Remote Console (RCON) passwords using the VS Code configuration API, which writes credentials to settings.json in plaintext [CWE-256]. Any process, user, or synchronization service with read access to the settings file can retrieve the RCON password used to administer a Minecraft server.

The issue affects versions 0.1.0 through 2.0.6 and is fixed in version 2.1.0. The maintainer released a patch that migrates existing passwords into VS Code's secure storage API.

Critical Impact
Plaintext storage of RCON credentials in settings.json exposes Minecraft server administrative passwords to anyone with local file access or access to synchronized VS Code settings.

Affected Products

Minecraft RCON Terminal VS Code extension version 0.1.0 through 2.0.6
Visual Studio Code environments where the extension is installed
Any Minecraft server whose RCON password was configured through the extension

Discovery Timeline

2025-10-03 - CVE-2025-61680 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61680

Vulnerability Analysis

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management by providing an integrated terminal for issuing RCON commands. To establish an RCON session, the extension needs a host, port, and password. In vulnerable releases, the extension persisted the password via the VS Code configuration API (workspace.getConfiguration().update(...)).

Settings written through this API are stored on disk in cleartext inside settings.json at the user or workspace scope. This behavior is documented and expected for configuration data, but it is unsuitable for secrets. As a result, RCON credentials were readable by any local user or process able to open the file, and by cloud-based Settings Sync mechanisms that replicate settings.json across devices.

An attacker who obtains the password can connect to the Minecraft server's RCON interface and execute administrative commands, including operator-level game commands and server shutdown operations.

Root Cause

The root cause is the use of a general-purpose configuration API for secret storage. VS Code exposes a dedicated SecretStorage API backed by the operating system keychain, which the vulnerable versions did not use. The weakness maps to CWE-256: Plaintext Storage of a Password.

Attack Vector

Exploitation requires read access to the user's settings.json file or to a synchronized copy of it. This can occur through local account compromise, a malicious VS Code extension with file system access, backup exfiltration, or a shared workstation. No authentication to the extension or the RCON server is required prior to reading the file.

typescript

// Patch from src/extension.ts (version 2.1.0) - migrates the RCON
// password from plaintext configuration into VS Code secure storage.
let ptyToController = new Map<RconTerminal, RconController>();
let currentConnection: { host: string; port: number; password: string } | null = null;

migratePasswordToSecureStorage(context).catch(err => {
  output.appendLine(`Password migration warning: ${err}`);
});

// Register the terminal profile provider
context.subscriptions.push(
  vscode.window.registerTerminalProfileProvider('minecraftRcon.terminal', {
// Source: https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877

Detection Methods for CVE-2025-61680

Indicators of Compromise

Presence of a minecraftRcon.password (or similarly named) key with a cleartext value in settings.json on developer workstations
Installation of Minecraft RCON Terminal extension versions 0.1.0 through 2.0.6 reported by VS Code extension inventory
Unexpected RCON logins to Minecraft servers from IP addresses associated with developer endpoints

Detection Strategies

Scan user profile directories for settings.json files and grep for RCON password fields written by the extension
Query endpoint inventory for the extension identifier and compare installed versions against 2.1.0
Review Minecraft server RCON logs for administrative command usage that does not correlate with known administrator activity

Monitoring Recommendations

Monitor Settings Sync destinations and cloud backups for settings.json files containing credential-like keys
Alert on new or modified VS Code extensions installed on production administrator workstations
Enable RCON connection logging on Minecraft servers and forward events to a centralized log platform for review

How to Mitigate CVE-2025-61680

Immediate Actions Required

Upgrade the Minecraft RCON Terminal extension to version 2.1.0 or later on every workstation where it is installed
Rotate all Minecraft server RCON passwords that were previously configured through the vulnerable extension
Remove any residual plaintext password entries from user and workspace settings.json files after upgrading

Patch Information

The fix is available in version 2.1.0. The patch introduces a migratePasswordToSecureStorage routine that moves existing passwords from the configuration API into VS Code's SecretStorage, which is backed by the operating system credential store. See the GitHub Security Advisory GHSA-4m33-hxqw-7j77 and the 2.1.0 release notes for details.

Workarounds

Uninstall the extension until it can be updated to version 2.1.0
Restrict RCON access at the network layer so only trusted administrator hosts can reach the RCON port
Avoid synchronizing VS Code settings that contain the affected extension configuration across devices or accounts

bash

# Verify the installed extension version and upgrade to the patched release
code --list-extensions --show-versions | grep -i minecraft-rcon
code --install-extension jaketcooper.minecraft-rcon@2.1.0 --force

# Remove any lingering plaintext password entries from user settings
# (adjust the path per operating system)
grep -i "minecraftRcon" "$HOME/.config/Code/User/settings.json"