Mojira Archive
MC-275626

Invalid book title length causes player kicks and item duplication

Modded clients can duplicate items and kick other players by sending a malformed ServerboundEditBookPacket (BookUpdateC2SPacket) while holding a book and quill. If the provided title field is longer than 32 characters the server will accept and save the book stack/components, but will be unable to re-encode it.
This will cause it to fail saving the player's inventory, which will roll back their inventory and kick them. It will also kick all other players in their render distance. This lets malicious players duplicate items.

To duplicate items:

  • obtain a book and quill and put the items you want to duplicate in your inventory
  • disconnect and reconnect to the server to save your inventory
  • put the items you want to duplicate in a chest
  • send the malicious packet
  • (you will get kicked) reconnect
  • notice that the inventory rolled back to an earlier state and that the items are back in your inventory
  • open the chest and collect your duplicated items

I have attached the stacktrace from a vanilla server running 1.21.1.

Fixed

antonio32a

[Mojang] Gegy

2024-08-18, 10:01 PM

2024-08-19, 11:55 AM

2024-08-19, 11:55 AM

1

2

Plausible

Networking

1.21.1

24w34a