PT-2022-28215 · Unknown · Pterodactyl Panel
Published
2022-01-21
·
Updated
2022-01-21
CVSS v3.1
6.0
Medium
| Vector | AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Pterodactyl Panel versions <= 1.6.6
Description
A vulnerability exists that could allow a malicious attacker who compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to remain logged in as the user the key belonged to. It is important to note that a malicious user must first compromise an existing API key for a user to exploit this issue. It cannot be exploited by chance and requires a coordinated attack against an individual account using a known API key.
Recommendations
For versions <= 1.6.6, update to version 1.7.0 to address the issue.
As a temporary workaround for those not wishing to upgrade, apply the provided patch to the AuthenticateKey.php file, changing
$this->auth->guard()->loginUsingId($model->user id); to $this->auth->guard()->onceUsingId($model->user id);.Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pterodactyl Panel