Component deserialize exploit

[SecretlyJealous]

Stack trace

Log: https://pastebin.com/KqcZQsV5
Crash report: https://pastebin.com/XYVfnEZf

This exploit is different to an older one I reported: #9510

Plugin and Datapack List

FastAsyncWorldEdit, LibsDisguises, BookExploitFix, protocollib

Actions to reproduce (if known)

No response

Paper version

git-Paper-160 (MC: 1.20.1)

Other

No response

[Warriorrrr]

The exception in the log seems to be thrown from a method in the BookExploitFix plugin, can you reproduce this issue without that plugin?

[electronicboy]

This is probably just going to be the lack of a depth limit

[SecretlyJealous]

Reproduced without that plugin: https://pastebin.com/Ln9qLwkM

[Outfluencer]

@SecretlyJealous how do you reproduced it?

[MiniDigger]

we dont share potential exploit POCs publicly.