CVE-2024-34068: Pterodactyl Wings Server-Side Request Forgery Vulnerability
Summary
CVE-2024-34068: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings. Affects github.com/pterodactyl/wings versions < 1.11.12. Fixed in 1.11.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package that provides remote file pull functionality. It is commonly used in server management systems. The package allows users to remotely pull files from specified sources. However, a vulnerability has been discovered in the package that enables Server-Side Request Forgery (SSRF) attacks during the remote file pull process.
Vulnerability Detail
The vulnerability in Pterodactyl Wings allows an attacker to manipulate the remote file pull feature to make unauthorized requests to internal resources. By exploiting this vulnerability, an attacker can potentially bypass security measures and access sensitive information or perform actions on behalf of the server. This can lead to various consequences, including unauthorized data disclosure, privilege escalation, or even complete compromise of the affected system.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.12
This is the first release that contains the fix.
go get github.com/pterodactyl/wings@v1.11.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update the package to the latest version as soon as possible to mitigate the risk of exploitation.
Conclusion
The Pterodactyl Wings package is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability during remote file pull. It is crucial to update the package to version 1.11.12 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Pterodactyl Wings is a Go package used for remote file pull functionality in server management systems.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make unauthorized requests to internal resources from a targeted server.
The vulnerability can lead to unauthorized data disclosure, privilege escalation, or complete compromise of the affected system.
To fix this vulnerability, update the Pterodactyl Wings package to version 1.11.12 or later.
Currently, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
