GHSA-wwgq-9jhf-qgw6

Source

https://github.com/advisories/GHSA-wwgq-9jhf-qgw6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-wwgq-9jhf-qgw6/GHSA-wwgq-9jhf-qgw6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-wwgq-9jhf-qgw6

Aliases

CVE-2021-41273

Related

CVE-2021-41273

Published

2021-11-18T15:46:57Z

Modified

2023-11-01T04:56:30.740087Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

Details

Impact

Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints:

Sending a test email.
Generating a node auto-deployment token.

At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system.

Patches

This has been addressed in https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5 which will be released as 1.6.6.

Workarounds

Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.

Database specific

{
    "nvd_published_at": "2021-11-17T20:15:00Z",
    "github_reviewed_at": "2021-11-17T14:37:10Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-352"
    ]
}

References

Affected packages

Packagist / pterodactyl/panel

Package

Name: pterodactyl/panel
Purl: pkg:composer/pterodactyl/panel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.6

Affected versions

v0.*

v0.1.0-beta

v0.1.1-beta

v0.1.2-beta

v0.2.0-beta

v0.3.0-beta

v0.4.0-beta

v0.4.1-beta

v0.5.0-rc.1

v0.5.0-rc.2

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.6.0-beta.1

v0.6.0-beta.2

v0.6.0-beta.2.1

v0.6.0-rc.1

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.7.0-beta.1

v0.7.0-beta.2

v0.7.0-beta.3

v0.7.0-beta.4

v0.7.0-rc.1

v0.7.0-rc.2

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.19

v0.8.0-alpha.1

v0.8.0-alpha.2

v1.*

v1.0.0-beta.1

v1.0.0-beta.2

v1.0.0-beta.3

v1.0.0-beta.4

v1.0.0-beta.5

v1.0.0-beta.6

v1.0.0-beta.7

v1.0.0-rc.1

v1.0.0-rc.2

v1.0.0-rc.3

v1.0.0-rc.4

v1.0.0-rc.5

v1.0.0-rc.6

v1.0.0-rc.7

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.2.0

v1.2.1

v1.2.2

v1.3.0

v1.3.1

v1.3.2

v1.4.0

v1.4.1

v1.4.2

v1.5.0

v1.5.1

v1.6.0

v1.6.1

v1.6.2

v1.6.3

v1.6.5