PT-2024-25678 · Unknown · Pterodactyl

Trixterthetux · Published 2024-05-03 · Updated 2025-06-06 · CVE-2024-34067

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.11.6

Description Importing a malicious egg or gaining access to a wings instance could lead to cross-site scripting (XSS) on the panel, potentially allowing an attacker to gain an administrator account. The impacted components include Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, and Validation rules. This issue requires an administrator to perform specific actions and cannot be triggered by a normal panel user.

Recommendations For versions prior to 1.11.6, update to version 1.11.6 to resolve the issue. No workaround is available other than updating to the latest version of the panel. As a temporary measure, consider restricting access to Egg Docker images and Egg variables to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34067

GHSA-384W-WFFR-X63Q

Affected Products

Pterodactyl

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34067.json · Exploit
• https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2 · Patch
• https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q · Vendor Advisory
• https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16 · Patch
• https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-34067 · Security Note
• https://osv.dev/vulnerability/GHSA-384w-wffr-x63q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34067 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://twitter.com/CVEnew/status/1786770954510623175 · Twitter Post
• https://t.me/cvenotify/124956 · Telegram Post
• https://twitter.com/linuxpatch/status/1786473440834093157 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1786494925338460437 · Twitter Post