mojira.dev
MC-280464

The clientbound Container Close packet lacks validation on client

The clientbound container close packets, which is sent by server to close currently open container menu, neither validates if the current screen should be closable (was/is synchronized with server, instead of just being pause menu / chat) nor if the client side opened container id matches one from the packet (packet contains the container id, but ultimately it goes unused).

The related code can be found in net.minecraft.client.multiplayer.ClientPacketListener in method handleContainerClose(ClientboundContainerClosePacket), which calls this.minecraft.player.clientSideCloseContainer(), a method that closes current synchronized container and closes active screen, without any checks.

Comments 1

Can confirm. Servers can indeed use the clientbound container_close packet to close any screen on the client including ones not belonging to containers such as the pause menu or player report screen.

Patbox

(Unassigned)

Community Consensus

Platform

Normal

Networking

1.21.4, 25w09b

Retrieved