CVE-2024-22779
📋 TL;DR
This CVE describes a directory traversal vulnerability in Kihron ServerRPExposer v1.0.2 and earlier that allows remote attackers to execute arbitrary code via the loadServerPack function. Attackers can exploit this to read, write, or execute files outside the intended directory. Anyone running vulnerable versions of this Minecraft server mod is affected.
💻 Affected Systems
- Kihron ServerRPExposer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to complete system takeover, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, mine cryptocurrency, or disrupt server operations.
If Mitigated
Limited impact with proper network segmentation and minimal privileges, potentially only affecting the Minecraft server process.
🎯 Exploit Status
Proof of concept available in GitHub gist. Exploitation requires network access to the Minecraft server port.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 8f7b829df633f59e828d677f736c53652d6f1b8f
Vendor Advisory: https://github.com/Kihron/ServerRPExposer/commit/8f7b829df633f59e828d677f736c53652d6f1b8f
Restart Required: Yes
Instructions:
1. Update ServerRPExposer mod to latest version. 2. Restart Minecraft server. 3. Verify the fix by checking mod version.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to Minecraft server port (default 25565) to trusted sources only.
iptables -A INPUT -p tcp --dport 25565 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 25565 -j DROP
Remove Vulnerable Mod
allTemporarily remove ServerRPExposer mod until patched.
rm /path/to/minecraft/mods/ServerRPExposer.jar
🧯 If You Can't Patch
- Disable or remove the ServerRPExposer mod completely.
- Implement strict network segmentation and firewall rules to limit access to the Minecraft server.
🔍 How to Verify
Check if Vulnerable:
Check mod version in server logs or mods folder. If version is 1.0.2 or earlier, system is vulnerable.Check Version:
Check the mod JAR file name or server startup logs for 'ServerRPExposer' version.Verify Fix Applied:
Verify ServerRPExposer mod has been updated beyond version 1.0.2 or removed from mods directory.📡 Detection & Monitoring
Log Indicators:
- Unusual file path requests in server logs
- Suspicious loadServerPack operations
- Error messages related to file access outside expected directories
Network Indicators:
- Unusual traffic patterns to Minecraft server port
- Multiple failed file access attempts followed by successful exploitation
SIEM Query:
source="minecraft.log" AND "loadServerPack" AND (".." OR "/etc" OR "/root" OR "C:\")🔗 References
- https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed
- https://github.com/Kihron/ServerRPExposer/commit/8f7b829df633f59e828d677f736c53652d6f1b8f
- https://modrinth.com/mod/serverrpexposer
- https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed
- https://github.com/Kihron/ServerRPExposer/commit/8f7b829df633f59e828d677f736c53652d6f1b8f
- https://modrinth.com/mod/serverrpexposer
