CVE-2024-49762: Pterodactyl Panel Exposes User Passwords in Plain Text Logs
Summary
CVE-2024-49762: Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled. Affects pterodactyl/panel versions < 1.11.8. Fixed in 1.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Panel is an open-source game server management panel that allows users to manage their game servers through a web interface. It offers features such as user management, server management, and support for various game servers. However, it has a vulnerability related to the logging of sensitive user information, specifically passwords, when two-factor authentication is disabled.
Vulnerability Detail
The vulnerability arises when a user disables two-factor authentication (2FA) in the Pterodactyl Panel. During this process, a DELETE request is sent containing the user's current password as a query parameter. Although this data is encrypted during transmission via TLS, many web servers log query parameters in plain text. This means that if an attacker gains access to these logs, they could potentially retrieve the user's password and use it to authenticate against their account, provided they have the user's email address or username. The vulnerability is classified under CWE-313, which pertains to the use of sensitive data in logs.
How To Fix
Minimum fixed version
1.11.8
This is the first release that contains the fix.
composer require pterodactyl/panel:1.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds available to mitigate this vulnerability. The only effective solution is to update to the patched version or apply the patch manually.
Conclusion
In summary, CVE-2024-49762 is a significant vulnerability in the Pterodactyl Panel that can lead to the exposure of user passwords in plain text logs. Users are urged to update to version 1.11.8 or apply the provided patch to secure their accounts. Additionally, users should consider changing their passwords and enabling two-factor authentication to mitigate potential risks.
See every vulnerability recorded for pterodactyl/panel →
FAQ
CVE-2024-49762 is a vulnerability in the Pterodactyl Panel that exposes user passwords in plain text logs when two-factor authentication is disabled.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have disabled 2FA, it is recommended to change your password and consider re-enabling 2FA for added security.
The main risk is that an attacker could gain access to user passwords from server logs, allowing them to authenticate as the user if they also know the user's email or username.
To prevent this issue, always keep your Pterodactyl Panel updated to the latest version and enable two-factor authentication for enhanced security.
References
Related vulnerabilities
Recent vulnerabilities recorded for pterodactyl/panel.
