Mojira Archive
MC-64126

Recursive /execute can do a DoS

If you nest /execute several times, you can flood a server and do a denial of service attack (if you're op).
Explanations :
If you do:

/execute @e ~ ~ ~ say Hi!

it says "hi" n times where n is the number of entities.
If you do:

/execute @e ~ ~ ~ execute @e ~ ~ ~ say Hi!

it says "hi" n^2 times
In general it does n^x times where x is the number of repetition of "execute @e ~ ~ ~"
So repeating 10 times with 5 entities already do 9.7M of commands.
Possible fixes :
1. Limit number of commands executes (ex: 10000)
2. Disable recursive execute (do not allow execute inside execute commands)

EDIT 1 : The main concern is modified clients who can place command blocks and modify it. /stop is forbidden in command blocks. /execute is unregulated.
Corrected typo: it's not a DDos but a DoS
It may get worse if the command block is connected with fast redstone clock.

Won't Fix

theo

2014-07-28, 03:31 PM

2014-10-22, 12:02 PM

2014-10-22, 12:02 PM

0

2

Unconfirmed

exploit

Minecraft 1.7.10, Minecraft 14w30c

-