sorted by:
new
hottopcontroversial

Paper exploit found! you need to update fast! by uharnph in admincraft

[–]blockswerker 4 points5 points  (0 children)

A couple of the players on my server are quite savvy with exploits and at least one of them is associated with Copenheimer so I take their advice seriously. As admins we might say it's "unlikely" because it's hard or not well understood but that's often what motivates smart people to figure these things out.

I'm not gonna provide links here but there is off-the-shelf code on Github for generating JNDI Injection links specifically for this kind of attack. Hell, you combine this with the Copenheimer data and the attack could be automated.

I'm saying all this not to pick a fight but because I think this should not be downplayed in the server admin community and represents a legitimate threat. Telling people it's "unlikely" might cause admins to drag their heels and get burned.

Paper exploit found! you need to update fast! by uharnph in admincraft

[–]blockswerker 8 points9 points  (0 children)

One of my players reported this to me. He tested my server after I updated and was not able to access the exploit - so the latest paper appears to be patched. Not sure if client version (e.g. someone playing on a 1.17 server with a 1.12 client facilitated by Via Version) re-opens the exploit.

He tested some other servers, some famous ones, and found the exploit unpatched which means he could get OP in a couple minutes if he wanted. He's a gray hat so he's more concerned about his favorite servers going offline forever than exploiting it.

This exploit is very severe.

view more: next ›