CVE-2023-25152
📋 TL;DR
This vulnerability in Pterodactyl Wings allows attackers with existing server access to create arbitrary files and directories on the host system. This could lead to privilege escalation, unauthorized resource allocation changes, or remote shell access. Only users running affected Wings Daemon versions are impacted.
💻 Affected Systems
- Pterodactyl Wings Daemon
📦 What is this software?
Wings by Pterodactyl
Wings by Pterodactyl
Wings by Pterodactyl
Wings by Pterodactyl
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full control of the host system through SSH key injection, container privilege escalation, and arbitrary file creation leading to complete compromise.
Likely Case
Attackers modify resource allocations, create unauthorized files, and potentially gain elevated container privileges to execute malicious code.
If Mitigated
With proper network segmentation and minimal user access, impact is limited to the specific compromised container instance.
🎯 Exploit Status
Exploitation requires existing server access but is straightforward once that access is obtained. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.7.3 for 1.7 series, v1.11.3 for 1.11 series
Vendor Advisory: https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5
Restart Required: Yes
Instructions:
1. Stop the Wings Daemon service
2. Backup current configuration
3. Download and install the patched version (v1.7.3 or v1.11.3)
4. Restart the Wings Daemon service
5. Verify service is running correctly
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Wings Daemon from critical systems
- Apply principle of least privilege to all user accounts with server access
- Monitor for unusual file creation patterns in container host directories
🔍 How to Verify
Check if Vulnerable:
Check Wings Daemon version: wings version. If version is v1.7.0-v1.7.2 or v1.11.0-v1.11.2, system is vulnerable.Check Version:
wings versionVerify Fix Applied:
After patching, verify wings version shows v1.7.3 or v1.11.3. Test that file creation restrictions are properly enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation patterns in container host directories
- Unauthorized attempts to modify resource allocations
- Suspicious SSH key modifications in authorized_keys files
Network Indicators:
- Unexpected outbound connections from Wings-managed containers
- Unusual API calls to Wings management interface
SIEM Query:
source="wings.log" AND ("file creation" OR "directory creation" OR "resource allocation")🔗 References
- https://github.com/pterodactyl/wings/commit/dac9685298c3c1c49b3109fa4241aa88272b9f14
- https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5
- https://github.com/pterodactyl/wings/commit/dac9685298c3c1c49b3109fa4241aa88272b9f14
- https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5
