tradesystem: arbitrary item give vulnerability

overview

the popular plugin TradeSystem had a critical vulnerability with plugin messaging. you could:

• give yourself items
• possibly (unlikely) achieve RCE via insecure deserialization
• spam people
• ban people
• wipe people

.. and more!

patch

there has been a patch to the github repository but it has not reached an official release yet. for now, please use this build or build from the develop branch.

technical details

this exploit relies on a relatively unknown fact of plugin messages not being secure when a proxy plugin isnt there to block them.

what tradesystem did was always register the plugin messaging channel instead of a configuration option enabling it. this enabled normal players to send custom payload packets on that channel pretending to be from the proxy, which allowed a cross-server trade being spoofed.

so this was the attack chain:

• send a fake player online packet
• initialise trade
• make the fake player put items into the trade inventory
• cancel the trade
• profit