GHSA-gqmf-jqgv-v8fw

Suggest an improvement
Source
https://github.com/advisories/GHSA-gqmf-jqgv-v8fw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-gqmf-jqgv-v8fw/GHSA-gqmf-jqgv-v8fw.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-gqmf-jqgv-v8fw
Aliases
Related
Published
2024-05-03T20:28:10Z
Modified
2024-06-04T16:58:36.176980Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Pterodactyl Wings vulnerable to Arbitrary File Write/Read
Details

Impact

If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to.

Workarounds

Enabling the ignore_panel_config_updates option or updating to the latest version of Wings are the only known workarounds.

Patches

https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de

Database specific
{
    "nvd_published_at": "2024-05-03T18:15:09Z",
    "cwe_ids": [
        "CWE-552"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-03T20:28:10Z"
}
References

Affected packages

Go / github.com/pterodactyl/wings

Package

Name
github.com/pterodactyl/wings
View open source insights on deps.dev
Purl
pkg:golang/github.com/pterodactyl/wings

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.12