Important information for everyone who plays Minecraft (Java Edition) multiplayer:
There is a very serious exploit that has recently been found in Minecraft (as of Dec 9 2021) that affects nearly every version of the game, both modded and vanilla.
You should avoid playing on public Minecraft servers until this vulnerability is patched on the respective Minecraft version you play on. Mojang has not yet addressed this at time of posting, it is unknown if they will retroactively patch older MC versions or not. (I suspect they will, but that cannot be guaranteed yet.)
The exploit in question allows for RCE by means of sending a malicious chat message. Yes, you read that right- a chat message. This means that a malicious actor could steal your passwords/session tokens from ram, install viruses etc on your computer. It's real bad.
Both Clients and Servers alike are affected by this.
Fortunately, modern versions of minecraft (since 1.16 - 1.18) are spared the worst effects of this exploit from what I know. There is still a chance that malicious actors could lag your game/servers on these versions, but for the most part playing on these versions should be OK. [EDIT: Disregard this whole paragraph! It's wrong!!! Your client/server are only safe if you receive a software patch to update this, and only on versions 1.17+ at that! AND only if both the client and server it's connected to have both received this patch!]
This exploit is known to exploit all versions of Minecraft 1.12.2 up to Minecraft 1.15.2 [EDIT: actually up to 1.18], regardless of vanilla/modded status, on both the server and client. If you play on these minecraft versions, ABSOLUTELY AVOID PLAYING ON ANY PUBLIC SERVERS, as your computer and personal information could be at risk. It is possible that older versions of Minecraft could be affected as well, essentially any version of minecraft which uses Java 8 could potentially be affected. [EDIT: There have been reports of this exploit affecting version 1.7, 1.8, etc. The java version is irrelevant.]
A band-aid fix you can apply is to add the following startup flags to Minecraft when launching the game:
-Dlog4j2.formatMsgNoLookups=true
But I wouldn't recommend relying on this, as the server you connect to could still be vulnerable itself.
Again, I recommend not playing multiplayer at all until mojang delivers some kind of patch to all clients, even then be wary about servers on older versions (1.16.5 and older).
I will update this post as more information becomes available. Stay safe, everyone.
EDIT 1 (6:26 pm): The jvm flag workaround only applies to Minecraft 1.17 and later. This contradicts things I've seen reading the papermc discord server, but it comes from a reliable source (the fabric modloader developers).
[image ID: Discord message that reads: "Update: The above workarounds only cover Minecraft 1.17 and later, avoid running servers or connecting to servers for earlier versions!" end ID]
It is possible that some misinformation is being spread on this, perhaps to curb the amount of people using this exploit via obfuscation. I don't want to give the impression that you could be safe when I'm not sure, so for now don't even try to play on any server below Minecraft 1.17 at all (or connect to any server using a minecraft client below version 1.17).
EDIT 2 (7:00 pm): I am seeing a lot of people saying that the JVM flag workaround doesn't help at all, or that it only helps for minecraft versions 1.17+. For the time being, just avoid playing minecraft multiplayer entirely, unless you are certain that both the client you are using and server you are playing on has patched this issue. THE JAVA VERSION YOU USE DOES NOT MATTER!!! I'VE CROSSED OUT THE INFORMATION IN THE INITIAL POST THAT IS NOW KNOWN TO BE INCORRECT. I apologize for spreading information before I knew more.
As far as I am aware, if you are playing minecraft 1.17+, there is a patch available to the fabric modloader that fixes this exploit. The latest version of the fabric modloader (0.12.9) patches the exploit on both the client and server end (only for versions 1.17+). Again, you have to be certain that the server you are playing on is patched to be reasonably sure of anything- don't connect/play otherwise. Paper 1.17.1 build #398, and Paper 1.18 build #64 should patch this vulnerability as well, but there is still a lot of information coming out very quickly so nothing is certain at the moment.
theartofmadeline
blakekathryn
areudirty
