CVE-2021-33806
📋 TL;DR
CVE-2021-33806 is a remote code execution vulnerability in the BDew BdLib library for Minecraft, caused by insecure deserialization of untrusted data. Attackers can exploit this to execute arbitrary code on servers running vulnerable versions. This affects Minecraft servers and clients using the vulnerable BdLib library.
💻 Affected Systems
- BDew BdLib library for Minecraft
📦 What is this software?
Bdlib by Bdew
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attacker to execute arbitrary commands, install malware, steal data, or take control of the Minecraft server host system.
Likely Case
Remote code execution leading to server disruption, data theft, or installation of backdoors on vulnerable Minecraft servers.
If Mitigated
Limited impact with proper network segmentation and restricted server access, though exploitation could still disrupt Minecraft services.
🎯 Exploit Status
Exploitation requires sending malicious serialized data to the vulnerable application. The vulnerability is in a widely used library pattern (insecure deserialization) with known exploitation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.1.7 and later
Vendor Advisory: https://bdew.net
Restart Required: Yes
Instructions:
1. Download BdLib version 1.16.1.7 or later from official sources. 2. Replace the vulnerable BdLib JAR file in your Minecraft mods directory. 3. Restart the Minecraft server or client.
🔧 Temporary Workarounds
Remove BdLib Mod
allTemporarily remove the BdLib mod from your Minecraft installation if immediate patching isn't possible.
rm /path/to/minecraft/mods/bdlib-*.jar
Network Isolation
allRestrict network access to Minecraft servers to trusted networks only.
🧯 If You Can't Patch
- Isolate Minecraft servers on separate network segments with strict firewall rules
- Implement application whitelisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check the BdLib JAR file version in your Minecraft mods directory. Versions before 1.16.1.7 are vulnerable.Check Version:
java -jar bdlib-*.jar --version or check the JAR filenameVerify Fix Applied:
Verify that BdLib version 1.16.1.7 or later is installed and the server/client starts without errors.📡 Detection & Monitoring
Log Indicators:
- Java deserialization errors
- Unexpected process execution from Minecraft Java process
- Stack traces containing ObjectInputStream or serialization-related errors
Network Indicators:
- Unusual network traffic to/from Minecraft server port (default 25565)
- Suspicious Java serialized data in network packets
SIEM Query:
process_name:"java.exe" AND (process_command_line:"bdlib" OR process_command_line:"minecraft") AND event_type:"process_creation"🔗 References
- https://bdew.net
- https://github.com/bdew-minecraft/bdlib/commit/447210530ceec72fb3374efecb0930ed359d2297
- https://vuln.ryotak.me/advisories/46
- https://www.curseforge.com/minecraft/mc-mods/bdlib/files/3331330
- https://bdew.net
- https://github.com/bdew-minecraft/bdlib/commit/447210530ceec72fb3374efecb0930ed359d2297
- https://vuln.ryotak.me/advisories/46
- https://www.curseforge.com/minecraft/mc-mods/bdlib/files/3331330
