LogJackFix

LogJack Fix A spigot plugin to fix CVE-2021-44228 Log4j remote code execution vulnerability, to protect Minecraft clients. Building gradle build License Licensed under GPLv3 Copyright c 2021 lordpipe Contributing By making a contribution to this repository, I certify that: a The contribution was...

log4shell-minecraft-demo

Log4Shell CVE-2021-44228 minecraft demo This demo is used at education fairs to give potential future students an idea of the cybersecurity department at HTL Villach and on how everyday applications can be exploited Note: This entire demo uses Minecraft 1.8.8 Attacker The attacker in this scenari...

Log4j-PoC

Proof of Concept for Log4j CVE-2021-44228 Disclaimer This project is only for educational purposes. Introduction This is a proof of concept of the log4j rce adapted from HyCraftHD. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

log4j-shell-poc

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. Recently there was a new vulnerability in log4j, a java logging library that is very widely used in the likes of elasticsearch, minecraft and numerous others. In this repository we have made and example...

Log4J-RCE-Proof-Of-Concept

Log4J-RCE-Proof-Of-Concept CVE-2021-44228 This is a proof of concept of the log4j rce. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/apache/logging-log4j2/pull/608...

CVE-2021-44228

CVE-2021-44228 Abuse Log4J CVE-2021-44228 to patch CVE-2021-44228 in vulnerable Minecraft game sessions to prevent exploitation in the session : A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land...

minecraft-log4j-honeypot

Minecraft Log4j Honeypot This honeypots runs fake Minecraft server 1.7.2 - 1.16.5 without snapshots waiting to be exploited. Payload classes are saved to payloads/ directory. Requirements Golang 1.16+ Running Natively git clone https://github.com/Adikso/minecraft-log4j-honeypot.git cd...

MC-Log4j-Patcher

MC-Log4J-Patcher The goal of this project is to provide Minecraft players, and server owners, peace of mind in regards to the recently discovered Log4J exploit CVE-2021-44228. Currently this project looks for any Log4J format strings, not just jndi, and either replaces them or stops them from bei...

L4J-Vuln-Patch

NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...

mc-log4j-patcher

mc-log4j-patcher Replaces old vulnerable - CVE-2021-44228 Log4j2 version with the latest one 2.15.0 that contains the JNDI RCE fix. Tested on Spigot 1.12.2, PaperSpigot 1.8.8, PaperSpigot 1.17.1 This is intended to fix servers that are currently unsupported, such as PaperSpigot 1.8.8 Please check...

JndiRemover

JndiRemover A small mod aimed at eliminating the CVE-2021-44228 vulnerability by removing/disabling Jndi in Log4j and intercepting messages containing the text "$jndi:ldap://domainname.com/script", which will be removed. Supported versions of MC: Forge 1.7.10, 1.12.2...

cve-2021-44228-minecraft-poc

CVE-2021-44228 in Minecraft Java 16 Paper server build 397 Minecraft 1.17.1 Exploitation In Java 16 only deserialization attacks work by default using log4j. To exploit this there needs to be a vulnerable serializable class in the classpath. In the current state of this repository the server will...

BiblioRCE

An oversight within BiblioCraft which allows restricted server-side file manipulation. This method only requires BiblioCraft! Not too much trickery and no other mods are required to achieve code execution! CoreTweaks The original writeup focused on CoreTweaks can be found here. I recommend you re...

MAL-2026-17224 Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

Malicious code in fabric-asset-pipeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...

CVE-2026-54617

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

EUVD-2026-82391

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

CVE-2026-54617 GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

CVE-2026-54617 GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

CVE-2022-51016

PocketMine-MP 3.x (before 3.27.0) fails to implement Minecraft Bedrock protocol encryption, allowing an attacker who captures a valid login token to replay it and impersonate the victim through XBOX Live authentication until the JWT token expires (typically 2–3 days). The attack requires the targ...