CVE-2023-29478
📋 TL;DR
BiblioCraft mod for Minecraft has a path traversal vulnerability that allows attackers to write files to arbitrary locations on the filesystem. This can lead to remote code execution by writing malicious files to the Minecraft mods folder. Anyone running BiblioCraft versions before 2.4.6 is affected.
💻 Affected Systems
- BiblioCraft Minecraft mod
📦 What is this software?
Bibliocraft by Bibliocraftmod
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through remote code execution, allowing attacker to execute arbitrary commands, steal data, or install persistent backdoors.
Likely Case
Attacker gains code execution on the Minecraft server, potentially taking control of the game server and accessing server files.
If Mitigated
File writes are contained to safe directories, preventing code execution but potentially allowing limited file manipulation.
🎯 Exploit Status
Public exploit code exists (BiblioRCE), making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.6
Vendor Advisory: https://github.com/Nuchaz/BiblioCraft/releases/tag/v2.4.6
Restart Required: Yes
Instructions:
1. Stop Minecraft server. 2. Download BiblioCraft 2.4.6 from official sources. 3. Replace old BiblioCraft mod file in mods folder. 4. Restart server.
🔧 Temporary Workarounds
Remove BiblioCraft mod
allTemporarily remove the vulnerable mod until patching is possible
mv /path/to/minecraft/mods/BiblioCraft*.jar /path/to/backup/
Restrict file permissions
linuxLimit write permissions for Minecraft server process
chmod 755 /path/to/minecraft/mods/
chown root:root /path/to/minecraft/mods/
🧯 If You Can't Patch
- Isolate Minecraft server on separate network segment
- Implement strict firewall rules to limit access to Minecraft port (default 25565)
🔍 How to Verify
Check if Vulnerable:
Check BiblioCraft mod version in mods folder or server startup logsCheck Version:
ls -la /path/to/minecraft/mods/ | grep BiblioCraftVerify Fix Applied:
Confirm BiblioCraft-2.4.6.jar is present in mods folder and server starts without errors📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in server logs
- Attempts to access path traversal patterns like ../
Network Indicators:
- Unusual network traffic to Minecraft port from unexpected sources
SIEM Query:
source="minecraft.log" AND "../" AND ("write" OR "save")