CVE-2024-33369
📋 TL;DR
A directory traversal vulnerability in Plasmoapp RPShare Fabric mod v1.0.0 allows remote attackers to read arbitrary files on the server by manipulating file paths in download requests. This affects all users running the vulnerable version of this Minecraft server mod.
💻 Affected Systems
- Plasmoapp RPShare Fabric mod
📦 What is this software?
Rpshare by Plasmoapp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and lateral movement within the network.
Likely Case
Arbitrary file read allowing attackers to access sensitive configuration files, credentials, and other server data.
If Mitigated
Limited impact with proper network segmentation and file system permissions restricting access to critical files.
🎯 Exploit Status
Public proof-of-concept demonstrates file path traversal via the getFileNameFromConnection method.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Remove RPShare mod v1.0.0 from your server. 2. Check for updated version on official repository. 3. Restart Minecraft server.
🔧 Temporary Workarounds
Remove vulnerable mod
allCompletely remove the RPShare mod from your Minecraft server
rm /path/to/minecraft/mods/RPShare-1.0.0.jar
Network isolation
linuxRestrict network access to Minecraft server using firewall rules
iptables -A INPUT -p tcp --dport 25565 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 25565 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Minecraft server from sensitive systems
- Apply file system permissions to restrict access to sensitive directories and files
🔍 How to Verify
Check if Vulnerable:
Check if RPShare-1.0.0.jar exists in your mods directoryCheck Version:
ls /path/to/minecraft/mods/ | grep RPShareVerify Fix Applied:
Confirm RPShare-1.0.0.jar is removed from mods directory and server restarted📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in download requests
- Access to files outside expected directories
Network Indicators:
- HTTP requests with ../ sequences in file paths
- Unusual download patterns from Minecraft server
SIEM Query:
source="minecraft.log" AND "../" AND "download"