19 results · Feed
-
High 7.5
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints …
-
High 8.1
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without ch…
-
Medium —
Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
### Summary An unprotected user enumeration vulnerability exists in the account email update endpoint, allowing authenticated users to verify whether email addresses are registered on the panel through automated requests without rate limiting or CAPTCHA prote…
-
Low 2.3
Pterodactyl has a database resource limit bypass via race condition in Client API
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism us…
-
Critical 9.2
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about a…
-
High —
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
### Summary Deleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked. This can result in unintended and unauthorized acce…
-
Medium 6.0
Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits…
-
Medium 6.5
Pterodactyl TOTPs can be reused during validity window
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficien…
-
High 7.5
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows…
-
Low —
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
> [!NOTE] > Message from the Pterodactyl team: > > The Pterodactyl team has evaluated this as a minor security issue but does not consider it something that should be assigned a CVE, nor does it require active patching by vulnerable systems. > > This issue is…
-
Critical 10.0
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the…
-
Medium 4.6
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TL…
-
Medium 6.1
Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel
Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator ac…
-
Medium 6.0
Insufficient Session Expiration in Pterodactyl API
### Impact A vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to …
-
Medium 4.3
Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email a…
-
Medium 4.3
logout CSRF in Pterodactyl Panel
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-…
-
High 8.1
Authentication bypass in Pterodactyl
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token` input during the two-factor authentication process to reference a cache value not associated with th…
-
Medium —
XSS vulnerability when listing users on add & modify server pages.
### Impact An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server. ### Patches T…
-
High 7.5
Pterodactyl vulnerable to 2FA Sniffing
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.