CVE-2021-39177

Executive Summary

CVE-2021-39177 is an authentication bypass vulnerability in Geyser, a proxy bridge that allows Minecraft: Bedrock Edition clients to connect to Minecraft: Java Edition servers. Versions prior to 1.4.2-SNAPSHOT permit any network-accessible attacker to forge a LoginPacket containing a manipulated JSON Web Token (JWT), thereby impersonating any legitimate user on the server. The vulnerability carries a CVSS score of 7.4 (High) and there are no known workarounds; the sole remediation is upgrading to version 1.4.2-SNAPSHOT or later.

Technical Analysis

Geyser is a network proxy that translates network protocols between Minecraft: Bedrock Edition and Minecraft: Java Edition. The authentication flow relies on a JWT embedded in the LoginPacket, which is used to validate the identity of connecting Bedrock clients. This JWT is intended to contain cryptographically signed claims that bind the session to a specific Xbox Live or Java Edition account.

The vulnerability resides in the incorrect handling of this login JWT during the authentication handshake. The CNA title states that manipulation of the JWT token allows impersonation as any user, which classifies this vulnerability as an authentication bypass (CWE-287: Improper Authentication). An attacker who "can connect to the server" can forge a LoginPacket containing a deliberately malformed or manipulated JWT. The vulnerable code likely fails to validate the JWT's signature, audience, issuer, or expiry claims properly, or it trusts claims that should be cryptographically verified.

At the vulnerability-class level, the attack mechanism corresponds to a JWT authentication bypass. Standard JWT handling requires:

1. Signature verification using a secret or public key — a missing or bypassed check allows attackers to forge arbitrary claims.
2. Algorithm confusion — the server may accept "none" as an algorithm or allow HMAC using the server's public key as a secret.
3. Claim validation — the token may lack proper validation of the user identifier claim, allowing an attacker to inject a victim's UUID or username.

When any of these checks are absent or flawed, an attacker can craft a JWT that asserts the identity of any user known to the system. Since the JWT is part of the LoginPacket sent over the network, the attack surface is the network-facing proxy port used for Bedrock Edition connections.

The attack surface is significant because Geyser is designed to be directly exposed to the internet to allow Bedrock clients to connect from anywhere. This means the vulnerable endpoint is commonly reachable without network-level authentication.

The CVSS score of 7.4 reflects the network reachability (AV:N), the lack of required privileges (PR:N), the absence of user interaction (UI:N), and the high confidentiality impact (C:H) — impersonating a user leaks their private data and sessions.

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification: The attacker identifies a Geyser bridge instance by scanning for Minecraft Bedrock Edition protocol ports (default UDP port 19132) or by tracking server list advertisements. The attacker determines the server name and enumerates known usernames of legitimate players (via public server lists, chat logs, or prior session captures).

Step 2 — Flaw Trigger: The attacker connects to the server using any Bedrock Edition client or a custom network script. Instead of initiating a normal login with a legitimate JWT obtained through Xbox Live authentication, the attacker crafts a custom LoginPacket. The JWT within the packet is manipulated — specifically, the identity claims (username/uuid) are replaced with those of the victim, and any cryptographic protections (signature, algorithm) are removed or invalidated to bypass validation.

Step 3 — Payload / Execution: The forged LoginPacket is transmitted to the Geyser bridge. Since the server fails to correctly verify the JWT integrity, it accepts the manipulated token and associates the session with the victim's identity. From the Java Edition server's perspective, the attacker appears as the impersonated player with full privileges.

Step 4 — Post-Exploitation Impact: The attacker can:

• Execute commands with the victim's permissions (operator/de-admin privileges if the victim holds them).
• Access private in-game inventories, ender chests, and personal data.
• Send messages to other players while impersonating the victim (social engineering / phishing).
• Damage the victim's reputation by griefing or violating server rules under their name.
• In cases where the Java Edition server links to external services (e.g., Discord/whitelist integrations), obtained credentials may be used further.

No public PoC is available; the attack chain is inferred from the vulnerability class described (JWT token manipulation).

Impact Assessment

Business Impact: Geyser is used by Minecraft server operators to expand their player base to include Bedrock Edition users. A successful exploit compromises the integrity of the server's user identity system, which is the foundation of permissions, moderation, and trust in a multiplayer environment. For commercial server networks with paid ranks, cosmetics, or in-game economies, impersonation can lead to direct financial losses and eroded player trust.

Affected Systems: All Geyser deployments running versions prior to 1.4.2-SNAPSHOT. This includes both self-hosted and managed Geyser instances integrated with Java Edition servers.

Blast Radius: The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates a high confidentiality impact with no integrity or availability impact. The scope is changed (S:C), meaning the compromised component (Geyser proxy) affects resources beyond its security scope (the Java Edition server and all authenticated players). No known exploitation in the wild has been reported, and EPSS score is 0.01431 (70.6% percentile), indicating low immediate exploitation probability but non-zero.

Detection Guidance

Sigma Rule

title: Suspicious Geyser JWT Login Packet Manipulation
id: 5f8b9a2c-7d4e-4f1a-9b3c-2e6a8d0f1b4a
status: experimental
description: Detects geyser authentication attempts where JWT validation fails or login packets contain malformed tokens.
author: Valtersit Threat Intelligence
date: 2021/10/01
logsource:
    category: application
    product: geyser
detection:
    selection:
        event_type|contains: 'login'
        jwt_error|contains: 
            - 'signature verification failed'
            - 'malformed token'
            - 'invalid audience'
            - 'algorithm none'
            - 'jwt decode error'
    condition: selection
level: medium
tags:
    - attack.t1190
    - cve.2021.39177

YARA Rule

rule CVE_2021_39177_Geyser_JWT_Manipulation
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect Geyser LoginPacket with manipulated JWT tokens"
        cve = "CVE-2021-39177"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-39177"
        date = "2021-10-01"

    strings:
        $jwt_header_none = /eyJ[\w-]*\.eyJ[\w-]*\./  // JWT with only 2 segments (no signature)
        $alg_none = "alg" ascii nocase
        $jwt_marker = ".eyJ" ascii nocase
        $login_packet = "LoginPacket" ascii nocase
        
    condition:
        uint16(0) == 0x4D43 and
        2 of them
}

Suricata IDS Rule

alert udp any any -> any 19132 (msg:"CVE-2021-39177 - Geyser Minecraft Bedrock JWT Manipulation Attempt"; content:"|10|"; depth:1; content:"LoginPacket"; nocase; content:"eyJ"; content:"alg"; content:"none"; classtype:attempted-admin; sid:2021391771; rev:1; metadata:cve CVE-2021-39177;)

Elastic Detection

sequence by host.name
  [network where destination.port == 19132 and network.transport == "udp"]
  [file where event.action == "write" and process.name == "geyser"
   and stringContains(toLowerCase(file.name), "log")]
  [process where event.action == "exec" and process.args : "*jwt*error*"]

Splunk SPL Query

index=geyser sourcetype=geyser:log
| search "jwt" OR "token" OR "LoginPacket"
| rex field=_raw "(?i)(?P<jwt_error>signature|invalid|malformed|error)"
| where jwt_error!=""
| stats count by src_ip, host, jwt_error
| sort - count

Wazuh OSSEC Rule

<group name="geyser,">
  <rule id="391770" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">login</field>
    <regex>signature verification failed|malformed token|invalid audience|algorithm none</regex>
    <description>CVE-2021-39177 - Geyser JWT token manipulation detected</description>
    <group>authentication_failure,attack.t1190,cve_2021_39177,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1) Immediate Mitigations:

• Upgrade immediately to Geyser version 1.4.2-SNAPSHOT or later, which contains the patch for this issue.
• Restrict network access to the Geyser bridge by placing it behind a firewall that only allows connections from trusted IP ranges, if operationally feasible.
• Use a reverse proxy or VPN layer in front of Geyser to add an additional authentication barrier at the network level.

2) Patch/Upgrade Steps:

• Verify the current Geyser version with geyser version command or by inspecting the JAR manifest.
• Download the patched 1.4.2-SNAPSHOT build from the official GeyserMC repository.
• Stop the Geyser service, replace the JAR file, and restart.
• Monitor logs for failed JWT validation attempts post-upgrade to confirm patched behavior.

3) Long-Term Hardening:

• Subscribe to GeyserMC security advisory mailing lists or monitor the GitHub repository for future security patches.
• Enforce strong server-side authentication: use Java Edition's built-in authentication for privileged accounts and restrict operator rights to verified users.
• Implement network-level monitoring (as per the detection rules above) to detect anomalous connection patterns at the Bedrock edition proxy port.
• If Geyser is not required, disable the Bedrock listener entirely to remove the attack surface.
• For critical deployments, verify the patch independently by reviewing Geyser's source code in version 1.4.2-SNAPSHOT to confirm the JWT validation logic is corrected.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2021-39177
2. GeyserMC GitHub Security Advisory — https://github.com/GeyserMC/Geyser/security/advisories (refer to CVE-2021-39177)
3. GeyserMC Official Website — https://geysermc.org
4. First.org CVSS Calculator — https://www.first.org/cvss/calculator/3.1 (verify CVSS 7.4 vector)
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2021-39177 is NOT listed)

Exploit-in-the-Wild Evidence: None reported. No public PoC or exploit code is currently available. EPSS score of 0.01431 (70.6th percentile) indicates that while the vulnerability is not currently under mass exploitation, it has characteristics of historically exploited CVEs and should be prioritized accordingly.