Mojira Archive
REALMS-11637

Crashing Realms using /me @e exploit

Malicious players are able to crash a realm by sending crafted /me command packets to the server.

The are two commonly used attacks.

  1. Using the in-game chat, you can send /me §l§k @e @e @e @e @e @e @e (...) which causes server/client lag, and cause all players to drop.
  2. Using a hacked client, flooding the server with /me @e @e @e @e @e @e @e (...) causing the server to become unresponsive and dropping all clients. 

Attack 1 can be mostly mitigated by monitoring the chat with a behaviour pack, sending multiple \n characters to clear the chat, and kicking the offending player.

Attack 2 cannot be prevented since the server becomes unresponsive, and behaviour packs using @minecraft/server does not yet have the capability of intercepting commands, including /me.

It appears the server can't keep while expanding entities into a chat string. 

Awaiting Response

No3n3r

2024-01-08, 10:43 PM

2024-03-12, 12:01 PM

2024-03-12, 11:17 AM

0

4

Unconfirmed

1.20.51 (Bedrock)

-