Operator Privilege Escalation in PocketMine-MP by Non-Case Sensitive Removal

CVE-2021-48006

What is CVE-2021-48006?

The vulnerability in PocketMine-MP, prior to version 4.0.3, stems from improper case-insensitive matching during the removal of operator entries from the ops.txt file. This oversight allows an operator who has a name stored with non-lowercase letters to remain privileged, as the removeOp function only recognizes exact matches. Consequently, the operator's authority can persist even when revocation has been attempted, leaving the system exposed until manual intervention is enacted to remove the entry from ops.txt.

References