On 2021-12-10 the Log4Shell vulnerability (CVE-2021-44228) reached Minecraft. prop was the first to bring it to the server channels, forwarding the community advisory. It warned of a critical bug that seemed to reach back as far as 1.7, where an attacker “using chat messages” might execute arbitrary code 1.
kira, who runs the machine the world lives on, had already seen it: “ik just saw” 2. Minutes later he announced he was shutting the server off 3. His reasoning was blunt. You could “get rce/crash the server just by sending a message” 4.
The fix came in two steps. First kira “added security patch flag to startup script” 5. Then he disabled the server logs entirely, since logging was the route the exploit travelled, and told everyone the logs would stay off “until mojang/fabric pushes a proper patch” 6.
kira did not treat it only as a chore. Two days later he shared a video by one of his favourite cybersecurity YouTubers showing a working exploit 7. It was a small outage in the history of Axolotl SMP Season 1, but it is one of the few times the friends’ hobby server was caught up in a real internet-wide emergency.
Primary sources
-
Important Security Update There is a critical security bug present in all Minecraft versions, though it currently seems to go back as far as 1.7 . The situation is still developing and more information will come to ligh…
-
ik just saw
-
im shutting off tge server
-
you can get rce/crash the server just by sending a message
-
added security patch flag to startup script
-
logs are disabled due to the security patch, will fix once mojang/fabric pushes a proper patch
-
one of my fav cybersec youtubers made a working exploit: youtube.com/watch?v=7qoPDq41xhQ
