Sending multiple Encryption request packets could block players from joining every online server
A malicious server is able to send multiple encryption request packets causing the client to spam request the join server api. After some time the api blocks the IP address of the player causing him to be unable to join any online server for ~10 Minutes as all requests fail.
There is no verification if the encryption has been enabled already therefore allowing this.
The console will be flooded with exceptions because the client tries to add a new encryption pipeline segment for every packet with the same name but netty prevents this.
I added a screenshot of the decompiled fabric minecraft jar but it works in vanilla too.
I tested it in versions 1.8, 1.16, 21w14a and 21w15a. It worked in those versions assuming every version between and future versions work too.
I made a POC of this if you want more information or a demo contact me.
2021-04-14, 10:29 AM
2023-09-07, 02:19 PM
2023-09-07, 02:19 PM
1
2