CVE-2024-34068: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull
Summary
CVE-2024-34068: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull. Affects github.com/pterodactyl/wings versions < 1.11.12. Fixed in 1.11.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package that provides a control panel and management system for game servers. It allows users to remotely manage and monitor their game servers. The package is widely used in the gaming industry and provides various features for server administration. However, a vulnerability has been discovered in Pterodactyl Wings that allows authenticated users to bypass access controls and perform Server-Side Request Forgery (SSRF) attacks during remote file pulls.
Vulnerability Detail
The vulnerability in Pterodactyl Wings allows an authenticated user with access to a game server to bypass the implemented access control measures. This enables them to access internal endpoints of the node hosting Wings in the pull endpoint. By exploiting this vulnerability, malicious users can potentially access resources on local networks that would otherwise be inaccessible. The impact of this vulnerability can be significant, as it allows unauthorized access to sensitive resources and can lead to further exploitation of the affected system.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.12
This is the first release that contains the fix.
go get github.com/pterodactyl/wings@v1.11.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Alternatively, if updating to the latest version is not immediately feasible, users can enable the api.disable_remote_download option. This option disables the remote download functionality, which is the component affected by the vulnerability. By disabling this feature, the risk of exploitation through SSRF attacks is mitigated. However, it is still recommended to update to the latest version as soon as possible to fully address the vulnerability.
Conclusion
The vulnerability in Pterodactyl Wings allows authenticated users to bypass access controls and perform SSRF attacks. To mitigate this vulnerability, it is crucial to update to the latest version of Wings (1.11.12 or above) or enable the api.disable_remote_download option. It is recommended to take immediate action to ensure the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Pterodactyl Wings is a Go package that provides a control panel and management system for game servers. It allows users to remotely manage and monitor their game servers.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal or external resources on behalf of the vulnerable server. In this case, the SSRF vulnerability in Pterodactyl Wings allows unauthorized access to internal endpoints of the node hosting Wings.
The impact of this vulnerability is that authenticated users with access to a game server can bypass access controls and potentially access resources on local networks that would otherwise be inaccessible. This can lead to unauthorized access to sensitive information and further exploitation of the affected system.
To fix this vulnerability, it is recommended to update to the latest version of Wings (1.11.12 or above). This version includes a patch that addresses the SSRF vulnerability and prevents unauthorized access to internal endpoints.
Yes, users can enable the api.disable_remote_download option as a temporary workaround. This option disables the remote download functionality affected by the vulnerability. However, it is still recommended to update to the latest version to fully address the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
