Mods for Minecraft, known as modifications installed by server operators to enhance gameplay, have been found to contain critical security vulnerabilities. Specifically, the “OpenComputers” and “CC: Tweaked” mods have been identified as having flaws that can be exploited to access cloud service APIs such as Amazon’s AWS, Google’s Cloud Platform, and Microsoft’s Azure. This allows malicious individuals to extract sensitive information and potentially gain unauthorized access within the hosting provider network. Additionally, OpenComputers lacks filtering of IPv6 addresses, making it easier for the vulnerabilities to propagate within local IPv6 networks.
These vulnerabilities have been assigned CVE entries, with CC: Tweaked receiving the entry CVE-2023-37262 and OpenComputers being described by CVE-2023-37261. Both vulnerabilities have high CVSS scores, indicating a critical risk. To address these issues, cleaned versions of CC: Tweaked are available, while administrators must manually back up OpenComputers. The OpenComputers security advisory provides instructions for mitigation that administrators should implement promptly.
The security warning identifies the affected versions of CC: Tweaked as 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3. Minecraft administrators are urged to install the necessary updates as soon as possible.
It is worth noting that Minecraft mod packs have had their share of issues in the past. Just last month, mods infected with the Fractureiser malware made headlines. Therefore, it is crucial for administrators and players to remain vigilant and take necessary precautions to protect their Minecraft environments.
