# How to avoid losing your Minecraft server due to dangerous mods I'm sure many Minecraft server owners have experienced players trying to hack into their server and give themselves administrator privileges\. Of course, such behavior isn't limited to gaming, so I study it out of pure scientific curiosity to understand how and why it happens\. In this article, we'll look at a vulnerability in the Integrated Scripting mod\. ![1334_cve_minecraft/image1.png](https://import.viva64.com/docx/blog/1334_cve_minecraft/image1.png) ## Introduction > \*\*Disclaimer\\\!\*\* This article is not a guide to hacking servers\\\. It discusses the now\\\-fixed CVE\\\-2025\\\-27107 vulnerability in the \[Integrated Scripting\]\(https://github\.com/CyclopsMC/IntegratedScripting\) mod and explains how to protect against it\\\. It feels almost impossible to find a Java developer who has never played Minecraft\. And almost everyone who has played the game is familiar with its vast array of mods and the massive community that has formed around them\. As I briefly mentioned in my [previous article](https://pvs-studio.com/en/blog/posts/java/1219/), there are mods that transform the blocky game into a shooter or an RPG on par with some AAA titles\. The core of the ecosystem consists of mods that expand the existing gameplay\. [Integrated Dynamics](https://www.curseforge.com/minecraft/mc-mods/integrated-dynamics) is one of them\. ![1334_cve_minecraft/image2.png](https://import.viva64.com/docx/blog/1334_cve_minecraft/image2.png) > Integrated Dynamics is a mod for automating and managing in\\\-game systems\\\. It lets you build complex networks by combining redstone mechanics, logic gates, and energy grids\\\. The mode adds features for transferring items, liquids, and energy\\\. It also enables auto\\\-crafting, working with NBT data, and HTTP interactions\\\. You can use it to build sophisticated resource\-processing systems and large storage setups, or to streamline routine gameplay tasks\. In terms of capabilities, it resembles [Applied Energistics 2](https://www.curseforge.com/minecraft/mc-mods/applied-energistics-2), which we may explore in the future\. The mod has many add\-ons, but this article will focus on just one: [Integrated Scripting](https://www.curseforge.com/minecraft/mc-mods/integrated-scripting/files/all?page=1&pageSize=20&version=1.21.1&showAlphaFiles=hide)\. Integrated Scripting is an add\-on for the Integrated Dynamics mod that enables you to write scripts in JavaScript, which then can be stored in Variable Cards\. You can use these cards in data storage and transfer devices\. For example, you can use a logical function to specify which items and in which cases you want to transfer to the system\. ![1334_cve_minecraft/image3.png](https://import.viva64.com/docx/blog/1334_cve_minecraft/image3.png) How do you like the IDE? It covers the bare minimum: syntax highlighting and compiler output\. Line wrapping is an issue, though\. With the basics out of the way, let's move on to the CVE\. ## About CVE\-2025\-27107 Let's start with the name: what's a CVE? I'll give a brief outline here, but you can find a more detailed explanation at the [link](https://pvs-studio.com/en/blog/terms/6628/)\. The Common Vulnerabilities and Exposures \(CVE\) database catalogs known security vulnerabilities and flaws\. MITRE, a U\.S\. nonprofit organization that focuses on systems engineering, maintains it\. The catalog contains entries for each publicly known vulnerability that has already been fixed\. One of these entries applies to the mod we're dissecting\. CVE identifiers follow this format: CVE\-YEAR\-ID\. Now, let's put on our detective hats and start examining the CVE\-2025\-27107 case file\. On March 13, 2025, a post was published in the Security section of the official GitHub repository for the IntegratedScripting mod\. The [post](https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4823-hq77) described the possibility of arbitrary code execution using reflection\.
Arbitrary Code Execution Arbitrary Code Execution \(ACE\) enables an attacker to run any commands or code they choose on a target machine or within a target process\. [Remote Code Execution](https://pvs-studio.com/en/blog/terms/7011/) \(RCE\) is a type of arbitrary code execution that allows an attacker to remotely run commands on a target system without having physical access to it\.
According to [chc4](https://github.com/chc4), the post's author, calling `getClass().getClass()` on an exception object in a script returns the `java.lang.Class` object\. Reflection then allows to call `Class.forName`, which effectively executes arbitrary code on the server\. Here's a shortened example: ```cpp try { // attempt to obtain a ClassCastException idContext.ops.listGet(i, 1) } catch(e) { cls = e.getClass().getClass() console.log(cls) // java.lang.Class methods = cls.getMethods() forName = methods.filter(x => x.getName() == "forName" && x.getParameterCount() == 1 )[0] console.log(forName) // java.lang.Class.forName(java.lang.String) runtimeClass = forName.invoke(null, "java.lang.Runtime") getRuntimeMeth = runtimeClass.getMethod("getRuntime") runtime = getRuntimeMeth.invoke(null) execMethod = runtimeClass.getMethods() .filter(x => x.getName() == "exec" && x.getParameterCount() == 1 )[0] execMethod.invoke(runtime, "notepad.exe"); } ``` In the next section, we'll discuss how we managed to access Java reflection methods via JavaScript without encountering any restrictions\. For now, let's step into the crime scene\. First, we need Minecraft 1\.21\.1 with four mods at specific versions: * IntegratedDynamics\-1\.21\.1\-neoforge\-1\.29\.6 * IntegratedScripting\-1\.21\.1\-neoforge\-1\.0\.16 \(the vulnerability has been fixed since 1\.0\.17\) * IntegratedTunnels\-1\.21\.1\-neoforge\-1\.9\.2 * IntegratedTerminals\-1\.21\.1\-neoforge\-1\.6\.21 Next, we'll build the following structure in the game\. ![1334_cve_minecraft/image4.png](https://import.viva64.com/docx/blog/1334_cve_minecraft/image4.png) It's made of: * two chests; * a scripting terminal; * an item interface; * an item exporter; * three logical cables; * a scripting drive\. Then, we insert the script that runs `notepad.exe` into the card and put the card into the exporter\. After that, we just put the items in the chest and enjoy the magic: ![1334_cve_minecraft/image5.png](https://import.viva64.com/docx/blog/1334_cve_minecraft/image5.png) Instead of calling `notepad.exe`, the script can execute any OS command or, for example, add a player to the server admin list via the `ops.json` file\. Let's break down why this happened and how developers fixed the vulnerability\. ## The cause and the fix The way it works is simple: Integrated Scripting uses the [Polyglot](https://www.graalvm.org/latest/reference-manual/polyglot-programming/) compiler\. It enables various programming languages to run on the JVM, allowing the mod to interpret scripts and pass their results to the Integrated Dynamics system\. The `Context` class is responsible for executing code within the library\. Developers can configure it via `Context.Builder`, where they can specify which features will be available to the script: from access to Java objects to working with threads and input/output: The [ScriptHelpers\.java:46](https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L46) file ```cpp public static Context createBaseContext(....) { Context.Builder contextBuilder = Context .newBuilder() .engine(ENGINE) // .allowAllAccess(true) .allowCreateProcess(GeneralConfig.graalAllowCreateProcess) .allowCreateThread(GeneralConfig.graalAllowCreateThread) .allowIO(GeneralConfig.graalAllowIo) .allowHostClassLoading(GeneralConfig.graalAllowHostClassLoading) .allowExperimentalOptions(GeneralConfig.graalAllowExperimentalOptions) .allowNativeAccess(GeneralConfig.graalAllowNative) .allowHostAccess(HostAccess.ALL) // <= .allowInnerContextOptions(false); .... return contextBuilder.build(); } ``` Although the developers didn't allow direct access to Java classes, the [`allowHostAccess(HostAccess.ALL)`](https://www.graalvm.org/sdk/javadoc/org/graalvm/polyglot/Context.Builder.html#allowHostAccess(org.graalvm.polyglot.HostAccess)) setting in the snippet above grants the script full access to the reflection\. The documentation for the setting explicitly states: > Note that this policy allows unrestricted access to reflection\. It is highly discouraged from using this policy in environments where the guest application is not fully trusted\. This was the core mistake the mod developers made: they allowed access to reflection, which made it possible to execute arbitrary code in the Java environment where the server\-side of the mod runs\. That's exactly what we took advantage of in our "exploit\." The developers [fixed the vulnerability](https://github.com/CyclopsMC/IntegratedScripting/commit/b9e24adf9c7b3245a55c57fb870d84fa26794b37#diff-3f2280050ba128fbf701656a2c34ff202d2d7e84b18444dc613ba8caabb56355) by replacing `HostAccess.ALL` with a custom configuration built via [`HostAccess.Builder`](https://www.graalvm.org/sdk/javadoc/org/graalvm/polyglot/HostAccess.Builder.html) and moving all related settings into the mod's `GeneralConfig`\. Server administrators can now configure the [`allowPublicAccess`](https://www.graalvm.org/sdk/javadoc/org/graalvm/polyglot/HostAccess.Builder.html#allowPublicAccess(boolean)) setting themselves\. It controls whether the script has unrestricted access to reflection\. This setting is now disabled by default\. This is what the configuration file looks like now: [ScriptHelpers\.java:41](https://github.com/CyclopsMC/IntegratedScripting/blob/14c9df085935c843e2fc77701a09f73689771e8e/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L41) ```cpp .allowHostAccess(HostAccess.newBuilder() .allowPublicAccess(GeneralConfig.graalAllowHostPublicAccess) // default false .allowAllImplementations(GeneralConfig.graalAllowHostAllImplementations) .allowAllClassImplementations( GeneralConfig.graalAllowHostAllClassImplementations ) .allowArrayAccess(GeneralConfig.graalAllowHostArrayAccess) .allowListAccess(GeneralConfig.graalAllowHostListAccess) .allowBufferAccess(GeneralConfig.graalAllowHostBufferAccess) .allowIterableAccess(GeneralConfig.graalAllowHostIterableAccess) .allowIteratorAccess(GeneralConfig.graalAllowHostIteratorAccess) .allowMapAccess(GeneralConfig.graalAllowHostMapAccess) .allowAccessInheritance(GeneralConfig.graalAllowHostAccessInheritance) .build() ) ``` Similar vulnerabilities have surfaced in the Minecraft community more than once, unfortunately\. The [Log4Shell](https://en.wikipedia.org/wiki/Log4Shell) \([CVE\-2021\-44228](https://nvd.nist.gov/vuln/detail/cve-2021-44228)\) vulnerability is a prime example\. In 2021, it wreaked havoc on Minecraft and half of the internet\. A single error in a library led to widespread remote code execution and real panic among server administrators\. At the time, I was heavily involved in running Minecraft servers, and I clearly remember people offering to sell me "patched" Log4j versions that had the exploit removed\. Another serious incident occurred back in the 1\.7\.10 era: a remote code execution vulnerability in the BiblioCraft mod \([CVE\-2023\-29478](https://nvd.nist.gov/vuln/detail/CVE-2023-29478)\)\. An attacker could exploit a [path traversal](https://pvs-studio.com/en/blog/terms/6470/) vulnerability to plant a mod with a payload on the server, which would make exploitation both trivial and extremely dangerous\. ## Conclusion Experience shows that hacking a Minecraft server is easier than it seems\. The discovered vulnerability proved to be genuinely dangerous\. Fortunately, the developers released a fix, and the server owners timely updated the mode, which helped minimize the impact\. This story highlights why it's extremely important to exercise caution when modding games\. Even the most popular projects aren't immune to critical errors\. The vulnerable version of the mod \(1\.0\.16\) is still available on the [CurseForge mod page](https://www.curseforge.com/minecraft/mc-mods/integrated-scripting/files/all?page=1&pageSize=20&version=1.21.1&showAlphaFiles=hide), and users can download it without receiving any warnings\. To protect your code from such vulnerabilities, it's a good idea to regularly perform static code analysis\. It helps detect unsafe constructs, potentially dangerous logic sections, and errors that could lead to application security issues\. For example, the [V5339](https://pvs-studio.com/en/docs/warnings/v5339/) diagnostic rule in PVS\-Studio analyzer can detect remote code execution vulnerabilities in Polyglot\. We have a [free licensing option](https://pvs-studio.com/en/order/open-source-license/) for open\-source projects\.