CVE-2024-34066: Arbitrary File Write/Read in Pterodactyl wings
Impact
If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to.
Workarounds
Enabling the ignorepanelconfigupdates option or updating to the latest version of Wings are the only known workarounds.
Patches
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de
Other sources
Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the ignorepanelconfigupdates option as a workaround.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34066?
CVE-2024-34066 has a high severity rating due to the potential for arbitrary file read and write access if the Wings token is leaked.
How do I fix CVE-2024-34066?
To fix CVE-2024-34066, ensure that your Pterodactyl Wings installation is updated to version 1.11.13 or higher.
What is the impact of CVE-2024-34066?
The impact of CVE-2024-34066 is that leaking the Wings token allows attackers to access and manipulate files on the associated node.
Which versions of Pterodactyl Wings are affected by CVE-2024-34066?
CVE-2024-34066 affects Pterodactyl Wings versions up to 1.11.12 and 1.11.2.
Can I mitigate CVE-2024-34066 without upgrading?
Yes, you can mitigate CVE-2024-34066 by enabling the 'ignore_panel_config_update' option in the Wings configuration.