Security readout for executives and security teams
Plain-English summary
Minosoft, an open-source Minecraft Java Edition client, has a cryptography flaw where the encryption's initialization vector is set to the secret key itself instead of a random value. An attacker who can influence encrypted messages could recover the secret key, undermining session confidentiality. No patch or workaround is available. Impact is limited to users of this specific third-party client.
Executive priority
Low to moderate business priority. This affects a niche third-party Minecraft client, not enterprise software, and there is no known active exploitation. Treat it as a monitoring item unless the client is in use on managed devices.
Technical view
CryptManager.kt initializes the AES cipher with an IV equal to the secret key rather than a random value (CWE-329, Not Using a Random IV with CBC Mode). This exposes the stream to chosen-plaintext/chosen-ciphertext attacks that can leak the key. All Minosoft builds supporting Minecraft protocol 1.7 and later, starting at commit f1ae30e, are affected. CVSS 3.1 base is 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). No fixed version exists.
Likely exposure
Exposure is confined to hobbyist and developer endpoints running the Minosoft client. Enterprise environments are unlikely to deploy it, but employees or contractors who use Minosoft on corporate devices could expose session keys during Minecraft protocol sessions with malicious or compromised servers.
Exploitation context
No public reports of active exploitation and the CVE is not in CISA KEV. Exploitation requires the attacker to influence plaintext or ciphertext exchanged during an encrypted Minecraft session, which typically means a malicious or attacker-controlled server. Attack complexity is rated High in the CVSS vector.
Researcher notes
Root cause is a textbook CWE-329 pattern: reusing the secret key as the IV enables recovery attacks against the key material. Fix direction is straightforward once maintainers act — generate a cryptographically random IV per session and transmit it alongside the ciphertext per the protocol. Watch for divergent forks that may or may not carry the flaw.
Mitigation direction
- Inventory endpoints for Minosoft installations and restrict its use on corporate assets.
- Advise users to avoid connecting Minosoft to untrusted Minecraft servers until a fix ships.
- Monitor the Bixilon/Minosoft GitHub repository and advisory GHSA-rvr6-48rj-c94j for a patch.
- Where possible, prefer the official Mojang client over unpatched third-party clients.
- Treat any Minosoft-derived session credentials as potentially compromised and rotate as needed.
Validation and detection
- Search managed endpoints and software inventories for Minosoft binaries or the Bixilon/Minosoft repository clone.
- Confirm installed builds are at or after commit f1ae30e2b046a490026a8413b075685deb795122.
- Review CryptManager.kt to verify the IV construction still equals the secret key.
- Check the upstream GitHub Security Advisory GHSA-rvr6-48rj-c94j for a released fix or mitigation.
- Document exposure and share findings with vulnerability management for tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-329: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-56141 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L1.63.4GitHub_MVulnerability scoring details
Base CVSS 3.1 score
5MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Bixilon/Minosoft/security/advisories/GHSA-rvr6-48rj-c94jCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/Bixilon/Minosoft/blob/3a608abe2d0999e4e702cc1b2d28366884c7f31e/src/main/java/de/bixilon/minosoft/protocol/protocol/encryption/CryptManager.kt#L72CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Generation of Predictable IV with CBC Mode
Generation of Predictable IV with CBC Mode represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.