CVE-2024-34067
📋 TL;DR
This vulnerability in Pterodactyl Panel allows cross-site scripting (XSS) attacks when administrators import malicious eggs or access compromised wings instances. Attackers could potentially gain administrator accounts on the panel. Only administrators are directly affected since normal users cannot trigger this vulnerability.
💻 Affected Systems
- Pterodactyl Panel
📦 What is this software?
Panel by Pterodactyl
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrator access to the Pterodactyl Panel, potentially compromising all managed game servers and panel data.
Likely Case
An attacker with access to create malicious eggs or compromise wings instances executes XSS payloads to steal administrator session cookies or credentials.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution.
🎯 Exploit Status
Exploitation requires administrator actions or compromised wings instance access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.6
Vendor Advisory: https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q
Restart Required: Yes
Instructions:
1. Backup your panel database and configuration. 2. Update Pterodactyl Panel to version 1.11.6 using the official update process. 3. Restart the panel service and wings service. 4. Verify the update was successful.
🔧 Temporary Workarounds
No workaround available
allThe vendor states no workaround exists other than updating to the patched version.
🧯 If You Can't Patch
- Restrict administrator access to trusted personnel only
- Monitor for suspicious egg imports or wings instance access
🔍 How to Verify
Check if Vulnerable:
Check your Pterodactyl Panel version - if it's below 1.11.6, you are vulnerable.Check Version:
php artisan p:infoVerify Fix Applied:
Confirm your panel version is 1.11.6 or higher and check that the commit fixes are present in your installation.📡 Detection & Monitoring
Log Indicators:
- Unusual egg imports
- Administrator account activity from unexpected sources
- XSS payload patterns in egg configuration fields
Network Indicators:
- Suspicious requests to egg import endpoints
- Unexpected data exfiltration from panel
SIEM Query:
source="pterodactyl-panel" AND (event="egg.import" OR event="egg.update") AND (payload CONTAINS "script" OR payload CONTAINS "javascript:")🔗 References
- https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2
- https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16
- https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817
- https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q
- https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2
- https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16
- https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817
- https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q
