CVE-2024-29672 (Kotlin, published 2024-04-05T06:15Z)
Description: value: Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in KeyCallbacks.kt.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/zly2006/reden-is-what-we-made
Files changed:
src/main/java/com/github/zly2006/reden/access/ClientData.kt
src/main/java/com/github/zly2006/reden/debugger/tree/StageIo.kt
src/main/java/com/github/zly2006/reden/malilib/KeyCallbacks.kt
src/main/java/com/github/zly2006/reden/network/RvcTrackpointsC2SRequest.kt
src/main/java/com/github/zly2006/reden/rvc/gui/SelectionCreateScreen.kt
src/main/java/com/github/zly2006/reden/rvc/tracking/RvcRepository.kt
src/main/java/com/github/zly2006/reden/rvc/tracking/TrackedStructure.kt
src/main/java/com/github/zly2006/reden/rvc/tracking/WorldInfo.kt
Commit message: refactor: rvc (#81)

* added client/server for rvc structure
> sometimes for a very huge building, we have to request the server for all block data.
* fixed a security issue in the debug protocol


Vulnerable code:
            .map { RvcRepository(Git.open(it)) }
        constructors["update_block"] = Constructor { EmptyTickStage("update_block", it!!) }
        constructors["commands_stage"] = Constructor { EmptyTickStage("commands_stage", it!!) }
                    val file = mc.runDirectory.resolve("DEBUG_RVC_REQUEST_SYNC_DATA").resolve(name)
import com.github.zly2006.reden.rvc.tracking.RvcFileIO
import com.github.zly2006.reden.rvc.tracking.TrackPredicate
import com.github.zly2006.reden.rvc.tracking.TrackedStructure
            val structure = TrackedStructure(it.readString())
        val repository = RvcRepository.create(nameField.text, client!!.getWorldInfo())
    val name: String = git.repository.workTree.name
                TrackedStructure(name)
    fun checkout(tag: String) = TrackedStructure(name).apply {
        fun create(name: String, worldInfo: WorldInfo): RvcRepository {
            return RvcRepository(git).apply {
        fun clone(url: String): RvcRepository {
                Git.cloneRepository()
                    .call()
    name: String
        private fun ofLocal(world: ServerWorld): WorldInfo {
        if (isClient) {
                return server.getWorld(registryKey)
            }
            return MinecraftClient.getInstance().world
            return server.getWorld(registryKey)

Fixed code:
import net.minecraft.network.NetworkSide
            .map { RvcRepository(Git.open(it), side = NetworkSide.CLIENTBOUND) }
        constructors["update_block"] = Constructor { EmptyTickStage("update_block", it) }
        constructors["commands_stage"] = Constructor { EmptyTickStage("commands_stage", it) }
        constructors["set_block"] = Constructor { EmptyTickStage("set_block", it) }
            val rootFile = mc.runDirectory.resolve("DEBUG_RVC_REQUEST_SYNC_DATA").normalize()
                    val file = rootFile.resolve(name).normalize()
                    if (!file.startsWith(rootFile)) {
                        Reden.LOGGER.error("Zip entry $name is outside of root directory")
                        continue
                    }
import com.github.zly2006.reden.rvc.tracking.*
import com.github.zly2006.reden.utils.server
import net.minecraft.network.NetworkSide
            val structure = TrackedStructure(it.readString(), NetworkSide.SERVERBOUND)
            val origin = it.readBlockPos()
            structure.world = server.overworld
            structure.placementInfo = PlacementInfo(WorldInfo.ofLocal(server.overworld), origin)
        buf.writeBlockPos(structure.origin)
import net.minecraft.network.NetworkSide
        val repository = RvcRepository.create(nameField.text, client!!.getWorldInfo(), NetworkSide.CLIENTBOUND)
import net.minecraft.network.NetworkSide
    val name: String = git.repository.workTree.name,
    val side: NetworkSide
                TrackedStructure(name, side)
    fun checkout(tag: String) = TrackedStructure(name, side).apply {
        fun create(name: String, worldInfo: WorldInfo, side: NetworkSide): RvcRepository {
            return RvcRepository(git, side = side).apply {
        fun clone(url: String, side: NetworkSide): RvcRepository {
                git = Git.cloneRepository()
                    .call(),
                side = side
import net.minecraft.network.NetworkSide
    name: String,
    var side: NetworkSide
        if (side == NetworkSide.SERVERBOUND) return
import kotlinx.serialization.Transient
        fun ofLocal(world: ServerWorld): WorldInfo {
    @Transient
    var world: World? = null

        if (world != null) return world
        world = if (isClient) {
                server.getWorld(registryKey)
            }else
                MinecraftClient.getInstance().world
            server.getWorld(registryKey)
        return world