Server-Side Request Forgery (SSRF)
CVE-2024-34068
Summary
Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This issue affects versions 1.2.0 through 1.11.11. Users are advised to upgrade to version 1.11.12 or later. Users unable to upgrade may enable the `api.disable_remote_download` option as a workaround.
- LOW
- NETWORK
- LOW
- CHANGED
- NONE
- LOW
- LOW
- NONE
CWE-918 - Server-Side Request Forgery (SSRF)
Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.
References
Advisory Timeline
- Published
