PT-2021-23151 · Unknown · Pterodactyl

Hdvinnie · Published 2021-10-25 · Updated 2021-10-28 · CVE-2021-41176

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.6.3

Description A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint, such as "/api/v1/auth/logout". This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.

Recommendations For versions prior to 1.6.3, update to version 1.6.3 to resolve the issue. As a temporary workaround, consider restricting access to the sign-out endpoint until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-41176

GHSA-M49F-HCXP-6HM6

Affected Products

Pterodactyl

References · 8

• https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41176 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41176 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m49f-hcxp-6hm6 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6 · Note
• https://github.com/pterodactyl/panel/releases/tag/v1.6.3 · Note
• https://t.me/cibsecurity/31162 · Telegram Post