CVE-2023-25152 in Wings
Summary
by MITRE • 02/08/2023
Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on the target machine. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by the Wings Daemon. This vulnerability has been resolved in version `v1.11.3` of the Wings Daemon, and has been back-ported to the 1.7 release series in `v1.7.3`. Anyone running `v1.11.x` should upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`. There are no known workarounds for this vulnerability. ### Workarounds None at this time.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/09/2023
The vulnerability identified as CVE-2023-25152 affects Wings, which serves as the server control plane for the Pterodactyl platform. This represents a critical privilege escalation and arbitrary file creation flaw that fundamentally compromises the security boundaries of containerized server environments. The vulnerability exists within the Wings Daemon component that manages server allocations and container operations, creating a pathway for attackers to bypass normal file system access controls and manipulate the underlying host system. The flaw specifically enables unauthorized file and directory creation operations on the host system, which can be leveraged to establish persistent access mechanisms and escalate privileges beyond the intended container isolation boundaries.
This vulnerability manifests through a directory traversal or path manipulation flaw that allows authenticated attackers with existing server allocation access to create new files and directory structures on the host system. The technical implementation appears to involve insufficient input validation or sanitization of file paths during container operations, enabling attackers to specify arbitrary host paths for file creation. The exploitation chain begins with an attacker possessing a legitimate server allocation within the Pterodactyl system, which provides the initial foothold necessary to execute the malicious file creation operations. According to CWE classification, this vulnerability maps to CWE-22 Path Traversal and CWE-73 Path Traversal, as it involves improper handling of file paths that allows attackers to write to unintended locations on the file system.
The operational impact of CVE-2023-25152 extends far beyond simple file creation capabilities, as it provides attackers with multiple vectors for persistent compromise and privilege escalation. The ability to create files on the host system enables attackers to modify resource allocation parameters, potentially promoting containers to privileged mode which removes critical security boundaries. More concerning is the potential for attackers to add SSH authorized keys to the system, providing them with direct remote shell access to the compromised host machine. This creates a complete compromise scenario where attackers can establish backdoor access, escalate privileges beyond the container environment, and maintain persistence without requiring additional authentication mechanisms. The vulnerability essentially undermines the fundamental security model of containerized environments by allowing attackers to break out of container isolation and gain host-level access.
From an ATT&CK framework perspective, this vulnerability maps to multiple techniques including T1059 Command and Scripting Interpreter for executing commands, T1548 Abuse of Cloud Infrastructure for privilege escalation, and T1078 Valid Accounts for maintaining access. The attack surface is particularly concerning as it requires only an existing server allocation, meaning that legitimate users with access to the Pterodactyl panel can potentially exploit this vulnerability. The resolution implemented in versions v1.11.3 and v1.7.3 addresses the core path validation issues that enabled the arbitrary file creation. Organizations running affected versions should immediately implement the recommended upgrades without delay, as there are no viable workarounds available for this specific vulnerability. The lack of workarounds underscores the critical nature of this flaw, as administrators cannot simply modify configuration settings or implement temporary patches to mitigate the risk while maintaining service availability. The vulnerability highlights the importance of proper input validation and secure path handling in server control plane components that interface with host file systems.