PT-2021-24355 · Pterodactyl · Pterodactyl Wings

Trixterthetux · Published 2021-06-23 · Updated 2025-02-21 · CVE-2024-34068

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Pterodactyl Wings versions prior to 1.11.2

Description: An authenticated user with access to a game server can bypass previously implemented access control, potentially accessing resources on local networks that would otherwise be inaccessible. This issue allows malicious users to access internal endpoints of the node hosting Wings in the pull endpoint. The estimated number of potentially affected devices is not specified.

Recommendations: For versions prior to 1.11.2, upgrade to version 1.11.2 or later to resolve the issue. As a temporary workaround for users unable to upgrade, enable the api.disable remote download option.

Exploit

Fix

SSRF

Improper Access Control

Weakness Enumeration

CWE-918

CWE-284

CWE-441

Related Identifiers

CVE-2024-34068

GHSA-6RG3-8H8X-5XFV

GHSA-QQ22-JJ8X-4WWV

GO-2024-2815

Affected Products

Pterodactyl Wings

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34068.json · Exploit
• https://github.com/pterodactyl/wings/security/advisories/GHSA-qq22-jj8x-4wwv · Vendor Advisory
• https://github.com/pterodactyl/wings/commit/c152e36101aba45d8868a9a0eeb890995e8934b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-34068 · Security Note
• https://osv.dev/vulnerability/GHSA-6rg3-8h8x-5xfv · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2815 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qq22-jj8x-4wwv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34068 · Vendor Advisory
• https://github.com/pterodactyl/wings · Note
• https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv · Note
• https://pkg.go.dev/vuln/GO-2024-2815 · Note
• https://t.me/cvenotify/112016 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1786495178603106412 · Twitter Post
• https://twitter.com/CVEnew/status/1786770958029631680 · Twitter Post