CVE-2024-34066
published 2024-05-03CVE-2024-34066: Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it…
PriorityP346high8.4CVSS 3.1
AVNACLPRHUIRSCCHIHAH
EPSS
0.54%
41.5th percentile
Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | pterodactyl_wings | >= 0 < 1.11.12 | 1.11.12 |
| pterodactyl | wings | < 1.11.12 | 1.11.12 |
| pterodactyl | wings | < 1.11.2 | 1.11.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
osv·2024-06-04
CVE-2024-34066 Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
GHSA
Pterodactyl Wings vulnerable to Arbitrary File Write/Read
ghsa·2024-05-03
CVE-2024-34066 [HIGH] CWE-552 Pterodactyl Wings vulnerable to Arbitrary File Write/Read
Pterodactyl Wings vulnerable to Arbitrary File Write/Read
### Impact
If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to.
### Workarounds
Enabling the `ignore_panel_config_updates` option or updating to the latest version of Wings are the only known workarounds.
### Patches
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de
OSV
Pterodactyl Wings vulnerable to Arbitrary File Write/Read
osv·2024-05-03
CVE-2024-34066 [HIGH] Pterodactyl Wings vulnerable to Arbitrary File Write/Read
Pterodactyl Wings vulnerable to Arbitrary File Write/Read
### Impact
If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to.
### Workarounds
Enabling the `ignore_panel_config_updates` option or updating to the latest version of Wings are the only known workarounds.
### Patches
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964dehttps://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fwhttps://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964dehttps://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fw
2024-05-03
Published