5 results · Clear filters · Feed
-
Medium 5.5
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust…
-
Medium 5.0
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
In `wings/internal/ufs/fs_unix.go` (line 92-94), this function is defined and is used to change permissions of files in the server: ```go func (fs *UnixFS) fchmodat(op string, dirfd int, name string, mode FileMode) error { return ensurePathError(unix.Fchmodat…
-
Medium 6.4
Server-side Request Forgery during remote file pull in Pterodactyl wings
Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node…
-
Medium 6.4
Unchecked hostname resolution could allow access to local network resources by users outside the local network
### Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that wou…
-
Medium 6.5
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious use…