I've stumbled across people that don't really know how their MC servers got compromised, of course, as BungeeCord is used a lot these days, people often forget that Bungee as a Proxy still has exploits that can be used.
I'm here to tell you about an Exploit that can potentionally harm your Servers and how to protect against it.
Let me start by explaining on what it is and how it works.
Explanation
BungeeCord accepts connections from servers on your network. It works as a proxy, intercepting connections and routing them through to the servers you point them to. That's all fine and dandy until we get to the technical side. BungeeCord doesn't look at localhost IP's, as it has a function to connect to servers outside of the local network. (This is useful if you want to hide the IP's of the servers, run a BungeeCord Instance on a VPS and run the servers on a dedicated server)
Exploit
The actual exploit happens when you don't secure your instance enough, you bring up a BungeeCord Service yourself and input the Server's IP's. By doing this, you fool the servers into thinking Bungee is actually sending a player it's way and it accepts it. This enables the attacker to use a cracked client, bypass any authentication (If you're running auth's that require your BungeeCord instance) and use your account to mess up anything on the server that you have access to. BungeeCord requires Servers connecting to it to have offline-mode set to true in the Configuration Files.
Fixing the problem?
It's quite easy actually, there's a guide on Linux Distro's on BungeeCord's Spigot website.
What you essentially do is you either run a script that only allows Bungee to accept connections from certain IP's (Servers) or use a Firewall that does the same.
You can read more about it here: https://www.spigotmc.org/wiki/firewall-g...tributions
Hope everybody is a tad bit safer after this!
I'm here to tell you about an Exploit that can potentionally harm your Servers and how to protect against it.
Let me start by explaining on what it is and how it works.
Explanation
BungeeCord accepts connections from servers on your network. It works as a proxy, intercepting connections and routing them through to the servers you point them to. That's all fine and dandy until we get to the technical side. BungeeCord doesn't look at localhost IP's, as it has a function to connect to servers outside of the local network. (This is useful if you want to hide the IP's of the servers, run a BungeeCord Instance on a VPS and run the servers on a dedicated server)
Exploit
The actual exploit happens when you don't secure your instance enough, you bring up a BungeeCord Service yourself and input the Server's IP's. By doing this, you fool the servers into thinking Bungee is actually sending a player it's way and it accepts it. This enables the attacker to use a cracked client, bypass any authentication (If you're running auth's that require your BungeeCord instance) and use your account to mess up anything on the server that you have access to. BungeeCord requires Servers connecting to it to have offline-mode set to true in the Configuration Files.
Fixing the problem?
It's quite easy actually, there's a guide on Linux Distro's on BungeeCord's Spigot website.
What you essentially do is you either run a script that only allows Bungee to accept connections from certain IP's (Servers) or use a Firewall that does the same.
You can read more about it here: https://www.spigotmc.org/wiki/firewall-g...tributions
Hope everybody is a tad bit safer after this!
I sometimes come around and poke a few threads before leaving for a few months again.
![[Image: 21TpxRw.png]](https://i.imgur.com/21TpxRw.png)
