litematica-exploit-poc

## https://sploitus.com/exploit?id=EEE08AE4-D366-5052-960C-F6E7C456D8CA
#Litematica Exploit POC

Proof of Concept for Litematica’s arbitrary file writing vulnerability (CVE pending assignment). A malicious server can exploit this vulnerability to write arbitrary files (via path traversal) to clients running affected versions of Litematica. In severe cases, this can lead to the installation of malware on the client side. > **This project is intended only for security research and testing purposes in authorized environments.** Do not use it for any unauthorized targets. ## **Vulnerability Summary**

| Item | Description |
|---|---|
| Affected Versions | All versions of Litematica 1.21 to 1.21.11 |
| Vulnerability Type | Unauthorized arbitrary file writing / Path traversal |
| Root Cause | The file transfer payload lacks a Servux registration guard; `FileName` is constructed without validation |
| Fixed Version | 0.26.11 (and corresponding fixes for various MC versions in the table) |

For detailed technical analysis, refer to [VULNERABILITY_REPORT.md](VULNERABILITY_REPORT.md). ## **Build Process**

Required: Java 21

```powershell
gradlew build --no-daemon
```

Output: `build/libs/litematica-exploit-poc-1.0.0.jar`

## **Usage**

Place the built artifact in the `mods/` directory of the Fabric server. Deliver the attack payload to clients in the following order:

1. `111.png` → `C:\Users\Public\111.litematic.png` (proves arbitrary file writing)
2. `evilmod.jar` → `.minecraft/mods/evilmod.litematic.jar` (effective when the client is restarted; opens 111.png)

This method works only for clients running affected versions of Litematica. ## **Directory Structure**

```
litematica-exploit-poc/
├── src/main/java/com/example/litematica_exploit/
│   ├── ExploitMod.java          # Entrance: resource loading, JOIN events, scheduling orchestration
│   ├── LitematicaProtocol.java  # Protocol encoding / sharding / sending
│   ├── AttackPlan.java          # Definition of attack targets (deliverables → target paths)
│   └── RawPayload.java          # Network payload
├── src/main/java/com/example/evilmod/
│   └── EvilMod.java             # Malicious payload module
├── VULNERABILITY_REPORT.md      # Vulnerability analysis and POC development documentation
└── build.gradle
```

## **Disclaimer**

This project is solely for security research and vulnerability verification purposes. Users must ensure that:

- It is used only in environments with explicit authorization (their own servers, vulnerability training sites, authorized penetration tests);
- This project is not to be used for any illegal, malicious, or unauthorized purposes;
- Any consequences arising from the use of this project are the responsibility of the user. This vulnerability has been fixed by upstream projects. Please update Litematica to the fixed version promptly. ## **License**

[GPL-3.0](LICENSE)