alienstoearth/litematica-rce

This repository is a proof of concept demonstrating a now patched security bug in Litematica, a popular Minecraft mod for building and sharing structure blueprints called schematics. The author states plainly that it is for education and research only, and should not be used against any server or client without permission. The bug lived in the feature that lets a Minecraft server send schematic files to connected clients over a custom network channel. When a server sends a file, Litematica writes it to a specific folder on the player's computer based on a filename the server supplies. The problem was that Litematica did not check that filename for anything unusual. By sending a filename containing steps like "go up two folders", a malicious server could make the file land outside the intended folder and inside the player's Minecraft mods folder instead, as an ordinary Java mod file rather than a real schematic. The next time that player restarted their game, Minecraft would load that file as if it were a legitimate mod, running whatever code was inside it. The proof of concept includes a small server side Minecraft mod that crafts the exact three network messages Litematica expects during a schematic transfer, but with a manipulated filename, along with a script to swap in any Java file as the payload and a mod that loads it into the finished build. The author found out about the bug through a Discord server and then compared Litematica's patched and unpatched source code to understand exactly how the transfer protocol worked and where the missing check was. Litematica has since released version 0.26.11, which adds the missing filename check, so any client running that version or newer is not affected by this specific issue.