[BDS-16774] Split screen allows non-whitelisted players to join

I've marked this as private because I'm not sure how publically known this is, and is a serious security flaw in BDS.

When connected to a server which is locked down with a whitelist, as long as the first account joining the server is whitelisted, anyone else on the console can join via split screen.

Steps to reproduce:

Create a local BDS instance on your home network. Enable whitelist
Whitelist 1 account
Login to whitelisted account on xbox/playstation
connect to server
activate split screen mode using a non-whitelisted account

Expected result:

Console should show error that non-whitelisted account cannot join the server.

Actual result:

Non-whitelisted account can play on the server. There is no console log of the second account joining the server, but it does show the second account leaving.

Environment

Xbox, Playstation

Linked Issues

relates to2

MCPE-174284Split-screen allows players to impersonate others on Realms and serversPlausible

REALMS-10097Banned players can join with split screen in realmsIncomplete

Attachments1

bds-bug.png

Rayth

2022-08-11, 02:48:21 PM

Comments7

Maciej Piornik 2022-07-14, 12:45:25 PM

Does this issue still occur after updating to 1.19.10?

This ticket will automatically reopen when you reply.

Rayth 2022-08-11, 02:49:03 PM

[Bot] Arisa edited 2022-08-11, 02:49:09 PM

Can confirm this is still happening in 1.19.20 as per this screenshot of my console. Brand new server, only whitelisted myself. You can see me connecting and then I split screen the second account in which you can see disconnect but not join

Maciej Piornik 2022-09-08, 12:39:45 PM

edited 2022-09-15, 12:06:05 PM

It can be reproduced every time? Does it occur on 1.19.22?

This ticket will automatically reopen when you reply.

Rayth 2022-09-14, 03:56:30 PM

Can confirm it is still present in 1.19.22 exact same steps. I even attempted to join via console on the account that wasn't on the allowlist, got "You are not invited to play on this server" as expected, but then joined with the account that is on the allowlist, and the not allowed account could then split screen. This is a console specific bug where xbox or playstation players can bypass an allowlist to join servers.

I do realise joining 3rd party non-networked servers via console isn't officially supported, but everyone knows there are ways to do so and this just forms a massive security risk for griefers and trolls

Rayth 2023-04-19, 05:44:02 PM

Updated to include latest release. Still happens, however console logging can now show these players joining with the "X spawned" line that's now appearing.

Maciej Piornik 2023-05-08, 04:27:11 PM

Can you upload screenshot of console log with new information?

This issue will automatically reopen when you reply.