Pterodactyl Panel up to 1.11.7 Two-factor Authentication cleartext storage in file

Summaryinfo

A vulnerability has been found in Pterodactyl Panel up to 1.11.7 and classified as problematic. This affects an unknown part of the component Two-factor Authentication Handler. This manipulation causes cleartext storage in file. This vulnerability is tracked as CVE-2024-49762. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Pterodactyl Panel up to 1.11.7 and classified as problematic. Affected by this vulnerability is an unknown part of the component Two-factor Authentication Handler. The manipulation with an unknown input leads to a cleartext storage in file vulnerability. The CWE definition for the vulnerability is CWE-313. The product stores sensitive information in cleartext in a file, or on disk. As an impact it is known to affect confidentiality, and integrity. The summary by CVE is:

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it's unlikely that their account swill be compromised by this vulnerability, it's not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-49762 since 10/18/2024. The exploitation appears to be easy. Attacking locally is a requirement. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1555 according to MITRE ATT&CK.

Upgrading to version 1.11.8 eliminates this vulnerability. Applying the patch 75b59080e2812ced677dab516222b2a3bb34e3a4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Pterodactyl

Name

• Panel

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7

License

• open-source

Website

• Product: https://github.com/pterodactyl/panel/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion