CVE-2021-35054
📋 TL;DR
This vulnerability in Minecraft Java Edition allows attackers to delete arbitrary JSON files via path traversal when the server is configured with online-mode=false. It affects Minecraft servers running vulnerable versions with this specific configuration. Attackers can exploit this to delete critical server files, potentially causing service disruption.
💻 Affected Systems
- Minecraft Java Edition
📦 What is this software?
Minecraft by Minecraft
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through deletion of critical configuration files, world data, or plugin files leading to data loss and service disruption.
Likely Case
Targeted deletion of specific JSON files causing server instability, plugin failures, or world corruption.
If Mitigated
Limited impact to non-critical files if proper file permissions and backups are in place.
🎯 Exploit Status
Exploitation requires online-mode=false configuration and network access to server
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.17.1
Vendor Advisory: https://www.minecraft.net/en-us/article/minecraft-java-edition-1-16-5
Restart Required: Yes
Instructions:
1. Download Minecraft Java Edition 1.17.1 or later. 2. Stop the Minecraft server. 3. Replace the server.jar file with the patched version. 4. Restart the server.
🔧 Temporary Workarounds
Enable online-mode
allSet online-mode=true in server.properties to prevent exploitation
sed -i 's/online-mode=false/online-mode=true/g' server.properties
Restrict file permissions
linuxSet strict file permissions on server directories to prevent deletion
chmod 750 *.json
chmod 750 world/*
chmod 750 plugins/*
🧯 If You Can't Patch
- Set online-mode=true in server.properties immediately
- Implement strict file system permissions and regular backups of critical JSON files
🔍 How to Verify
Check if Vulnerable:
Check server.properties for 'online-mode=false' and verify Minecraft version is below 1.17.1Check Version:
java -jar server.jar --versionVerify Fix Applied:
Confirm server is running version 1.17.1 or later and online-mode=true is set📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in server logs
- Failed plugin loading due to missing JSON files
- World loading errors
Network Indicators:
- Unusual file access patterns from unauthenticated clients
- Multiple DELETE requests to JSON file paths
SIEM Query:
source="minecraft.log" AND ("deleted" OR "missing" OR "error") AND "json"