PT-2024-21651 · Pterodactyl · Pterodactyl Wings

Kurtthiemann · Published 2024-03-13 · Updated 2024-06-04 · CVE-2024-27102

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pterodactyl Wings versions prior to 1.11.9

Description This issue impacts anyone running the affected versions of Wings, potentially allowing access to files and directories on the host system. The full scope of impact is unknown, but reading files outside of a server's base directory is possible. An attacker must have an existing server allocated and controlled by Wings to exploit this issue. Details on exploitation are embargoed until March 27th, 2024, at 18:00 UTC.

Recommendations Update to version 1.11.9 to mitigate this issue. As there are no known workarounds, updating to the specified version is the recommended course of action. If you notice any major semantic differences after updating, please open an issue on the issue tracker so it can be resolved.

Exploit

Fix

Path traversal

Race Condition

Weakness Enumeration

CWE-22

CWE-362

CWE-363

Related Identifiers

CVE-2024-27102

GHSA-494H-9924-XWW9

GO-2024-2642

Affected Products

Pterodactyl Wings

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27102.json · Exploit
• https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287 · Patch
• https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-494h-9924-xww9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27102 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27102 · Vendor Advisory
• https://github.com/pterodactyl/wings · Note
• https://twitter.com/CVEnew/status/1768013763267973166 · Twitter Post
• https://t.me/pentestingnews/44680 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1768116379251773831 · Twitter Post
• https://twitter.com/vuldb/status/1768362849250980109 · Twitter Post