CVE-2024-27102
📋 TL;DR
This vulnerability in Pterodactyl Wings allows authenticated attackers with server access to read files outside their allocated sandbox directory, potentially accessing sensitive host system files. It affects all Wings users running versions before 1.11.9. The exact scope is unknown but includes file disclosure from the host filesystem.
💻 Affected Systems
- Pterodactyl Wings
📦 What is this software?
Wings by Pterodactyl
⚠️ Risk & Real-World Impact
Worst Case
Complete host filesystem compromise including reading sensitive configuration files, credentials, and potentially escalating to full system control.
Likely Case
Unauthorized reading of sensitive files outside the sandbox, potentially exposing credentials, configuration data, or other server files.
If Mitigated
Limited impact if proper network segmentation and minimal privileges are already implemented, though file disclosure remains possible.
🎯 Exploit Status
Exploitation details embargoed until March 27, 2024. Requires authenticated access to a Wings-controlled server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.9
Vendor Advisory: https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9
Restart Required: Yes
Instructions:
1. Stop all Wings instances. 2. Update to version 1.11.9 using your package manager or manual installation. 3. Restart Wings service. 4. Verify all servers are functioning correctly.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Wings instances from sensitive systems
- Apply principle of least privilege to all user accounts and server permissions
🔍 How to Verify
Check if Vulnerable:
Check Wings version with 'wings --version' or examine service logs for version informationCheck Version:
wings --versionVerify Fix Applied:
Confirm version is 1.11.9 or higher using 'wings --version'📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Requests attempting to access paths outside normal server directories
- Errors related to file permission violations
Network Indicators:
- Unusual outbound connections from Wings instances
- Traffic patterns suggesting file exfiltration
SIEM Query:
source="wings" AND (event="file_access" OR event="permission_error") AND path CONTAINS ".."🔗 References
- https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287
- https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9
- https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287
- https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9
