Pterodactyl Wings prior 1.11.6 Installation unnecessary privileges

Summaryinfo

A vulnerability was found in Pterodactyl Wings. It has been rated as critical. Impacted is an unknown function of the component Installation. This manipulation causes unnecessary privileges. The identification of this vulnerability is CVE-2023-32080. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Pterodactyl Wings and classified as critical. Affected by this vulnerability is an unknown function of the component Installation. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. The CWE definition for the vulnerability is CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone running the affected versions of Wings. This vulnerability can be used to gain access to the host system running Wings if a user is able to modify an server's install script or the install script executes code supplied by the user (either through environment variables, or commands that execute commands based off of user data). This vulnerability has been resolved in version `v1.11.6` of Wings, and has been back-ported to the 1.7 release series in `v1.7.5`. Anyone running `v1.11.x` should upgrade to `v1.11.6` and anyone running `v1.7.x` should upgrade to `v1.7.5`. There are no workarounds aside from upgrading. Running Wings with a rootless container runtime may mitigate the severity of any attacks, however the majority of users are using container runtimes that run as root as per the Wings documentation. SELinux may prevent attackers from performing certain operations against the host system, however privileged containers have a lot of freedom even on systems with SELinux enabled. It should be noted that this was a known attack vector, for attackers to easily exploit this attack it would require compromising an administrator account on a Panel. However, certain eggs (the data structure that holds the install scripts that get passed to Wings) have an issue where they are unknowingly executing shell commands with escalated privileges provided by untrusted user data.

The weakness was shared 05/11/2023 as GHSA-p744-4q6p-hvc2. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-32080 since 05/01/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.11.6 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Pterodactyl

Name

• Wings

Website

• Product: https://github.com/pterodactyl/wings/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion