It is possible to hide certain admin commands and chat messages from logs in versions 1.7 through 1.11.2 due to CVE-2021-44228 mitigations
The Bug
The log filter in place for versions 1.7 through 1.11.2 allow for malicious users to have their chat messages not logged and thus not leaving proof of them existing.
For example, a malicious user could insult someone but also include a text that is filtered in the message like ${0}.
The same is true for certain commands, like /give @p wheat_seeds 1 0 {display:{Name:"${0}"}}
Steps to reproduce
- Start a server in the affected range using the mitigation steps from https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition for that version
- Send a message that is not filtered, e.g. "Hello, my dear friend!"
->
The message appears in the server log - Send a message that is filtered, e.g. "You absolute ${0}"
->
The message is not logged and no proof of it exists to the server admin
Expected result
The message should be logged.
Further thoughts
I do not know whether this is a valid bug, because (1) I don't know if a better way to mitigate the vulnerability in those versions even exists (other than code changes) and (2) these versions are not properly supported by Mojang anymore anyways.
2021-12-11, 06:10 PM
2022-01-18, 01:26 PM
2022-01-18, 01:26 PM
1
2
-