Pterodactyl Panel - Cross-site Scripting Vulnerability
Summary
CVE-2024-34067: Pterodactyl panel's admin area vulnerable to Cross-site Scripting. Affects pterodactyl/panel versions < 1.11.6. Fixed in 1.11.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Panel is an open-source web-based control panel used for managing game servers. It provides a user-friendly interface for administrators to manage various aspects of game server hosting. The panel is vulnerable to a Cross-site Scripting (XSS) attack in its admin area.
Vulnerability Detail
The vulnerability in Pterodactyl Panel's admin area allows an attacker to execute malicious scripts by importing a malicious egg or gaining access to a wings instance. This can lead to XSS attacks on the panel, potentially resulting in the compromise of an administrator account. The vulnerability affects Docker images used for eggs and various egg variables such as name, environment variable, default value, description, and validation rules. While certain fields may reflect malicious input, user interaction is required for the impact to occur. It is important to note that this vulnerability can only be exploited by administrators and not regular panel users.
How To Fix
Minimum fixed version
1.11.6
This is the first release that contains the fix.
composer require pterodactyl/panel:1.11.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is available for this vulnerability other than updating to the latest version of the panel.
Conclusion
The Pterodactyl Panel is vulnerable to a Cross-site Scripting (XSS) attack in its admin area. Administrators using versions prior to 1.11.6 should update to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pterodactyl/panel →
FAQ
Pterodactyl Panel is an open-source web-based control panel used for managing game servers. It provides a user-friendly interface for administrators to manage various aspects of game server hosting.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
Administrators using Pterodactyl Panel versions prior to 1.11.6 are affected by this vulnerability.
No, this vulnerability can only be exploited by administrators and requires their actions to trigger the impact.
No, the only solution is to update the panel to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for pterodactyl/panel.
