Skip to content

/plan player command can be used to enumerate complete player list

Moderate
AuroraLS3 published GHSA-cchm-2r9h-xvhv May 26, 2024

Package

maven com.djrapitops.Plan (Maven)

Affected versions

5.1 build 768 < 5.6 build 2865

Patched versions

5.6 build 2866

Description

Summary

The /plan player command can be used to enumerate a list of users who have joined the server. This may go against the wish of certain server owners (including me) allowing users to conduct reconnaisance to determine the users that have joined the server before.

Details

Users are able to enumerate a player list through the plan player command despite not given permission to do so.
This allows attackers to perform reconnaisance attacks on the server.

POC

  1. First check that the permission is not granted;
    [Thu 13:50:15 INFO ] [LP] Permission information for plan.player.other:
    [Thu 13:50:15 INFO ] [LP] - xtremecoder has plan.player.other set to false in context global.
    [Thu 13:50:15 INFO ] [LP] - xtremecoder does not inherit plan.player.other.
    [Thu 13:50:15 INFO ] [LP]
    [Thu 13:50:15 INFO ] [LP] Permission check for plan.player.other:
    [Thu 13:50:15 INFO ] [LP] Result: false
    [Thu 13:50:15 INFO ] [LP] Processor: common.DirectProcessor
    [Thu 13:50:15 INFO ] [LP] Cause: 9e440c9b-f7e6-4c96-aee7-b0b514511029 has plan.player.other set to false in context global
    [Thu 13:50:15 INFO ] [LP] Context: (dimension-type=overworld) (discordsrv:linked=false) (essentials:afk=false) (essentials:jailed=false) (essentials:muted=false) (essentials:vanished=false) (gamemode=adventure) (world=world)

  2. Note that when running the command, autocomplete allows me to effectively get a list of players that have joined the server.
    image

  3. When I run the command, I note that I do not have the permission
    image

  4. I also note that I am the only player online, thus the autocomplete was not based on online users

  5. image

Impact

This vulnerability has no direct impact.
This vulnerability allows attackers to perform reconnaisance in preparation for other attacks.

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE ID

No known CVE

Weaknesses

Credits