Mojira Archive
MC-208577

File system override

            File var7 = new File(this.skinsDirectory, var4.length() > 2 ? var4.substring(0, 2) : "xx");
            File var8 = new File(var7, var4);
            HttpTexture var9 = new HttpTexture(var8, var1.getUrl(), DefaultPlayerSkin.getDefaultSkin(), var2 == Type.SKIN, () -> {
                if (var3 != null) {
                    var3.onSkinTextureAvailable(var2, var5, var1);
                }

            });

This piece of code can be abused to overrie file system files.
Server may construct invalid hash that might lead to a such condition.
That allows server to overwrite critical OS files, even writing malicious payload to auto startup catalog.

Awaiting Response

__xDark

2020-12-16, 05:19 PM

2020-12-16, 06:42 PM

2020-12-16, 06:42 PM

0

1

Unconfirmed

(Unassigned)

20w49a

-