Bungee-spoofing attack
 | This article may be too technical for most readers to understand. |
Bungee spoofing is an attack against unfirewalled Bungeecord in which a player sends falsified player forwarding data (sent as part of the host field in the Handshake packet) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.
Solutions
While the following sections discuss possible issues with the following solutions, please note that these are entirely theoretical and have not been tested, and to the author's knowledge, have not been exploited in the wild. All of these theoretical attacks require sniffing attacks, and as such they are not practical in the majority of cases.
BungeeGuard is a BungeeCord, Spigot and Sponge plugin developed by lucko which attempts to solve this problem by adding a secret token to the end of the player forwarding data.
This works for most setups, but if the backend and frontend (the proxy) servers communicate over the Internet, it can be intercepted with a sniffing attack as the Handshake packet is not encrypted and the token is sent in plaintext. It may additionally be possible to perform a timing-based side-channel attack, as the function responsible for checking the token may not always execute in constant time.
As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a firewall is configured for every backend server that listens on a public network interface, or communications are done exclusively virtual private network providing encryption.
Velocity
Another possible solution is to use Velocity's modern forwarding, which uses a HMAC to verify player data sent in a Login Plugin Message.
It may be vulnerable to a replay attack as the Login Plugin Message packet is unencrypted on offline-mode servers, like those behind frontends like Velocity. As HMACs only serve to verify the authenticity of the attached data, the data they verify is not encrypted in any way and can be inspected by a network attacker.
Proxies like Velocity and Bungeecord must have backends configured in offline-mode, otherwise they will not be able to implement features like backend <-> frontend plugin messages and commands running on the frontend.
Even though Velocity's modern forwarding is a considerable improvement over both Bungeecord and Bungeeguard, virtual private networks or local networks remain the most secure solution. Additionally, configuring firewall rules to deny packets to your backend server's port from all IP addresses that do not belong to your frontend, if you are unable to bind on a local address.
