CVE-2024-27102: Github.com/pterodactyl/wings Pterodactyl Wings Vulnerable To Improper Vulnerability
CRITICALCVE-2024-27102 is a CRITICAL (CVSS 9.9) pterodactyl wings vulnerable to improper vulnerability (CWE-363: Race Condition Enabling Link Following) affecting Github.com/pterodactyl/wings libraries in the Go ecosystem. The issue involves pterodactyl wings vulnerable to improper isolation of server file access. Remediation is available by upgrading affected packages to version 1.11.9.
CVE-2024-27102 at a Glance
Security Impact
CVSS: 9.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
How to Fix CVE-2024-27102
To remediate this vulnerability, upgrade all affected Github.com/pterodactyl/wings dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/pterodactyl/wings to 1.11.9Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/pterodactyl/wingsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-27102, inspect your project dependencies for Github.com/pterodactyl/wings:
inspect dependencies for github.com/pterodactyl/wingsAnalyze the terminal output to locate any version of Github.com/pterodactyl/wings in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.11.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-363: Race Condition Enabling Link Following, where the product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file. In Github.com/pterodactyl/wings, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-27102 Affected Github.com/pterodactyl/wings Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/pterodactyl/wings
|
Go |
< 1.11.9
|
1.11.9
|
References
Frequently Asked Questions
What is CVE-2024-27102?
Which Github.com/pterodactyl/wings versions are affected?
What version fixes CVE-2024-27102?
Is github.com/pterodactyl/wings affected?
What is the CVSS score of CVE-2024-27102?
What CWE is associated with CVE-2024-27102?
How can I check Go dependencies for CVE-2024-27102?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-494h-9924-xww9",
"modified" : "2024-03-15T16:48:21Z",
"published" : "2024-03-15T16:48:21Z",
"aliases" : [ "CVE-2024-27102" ],
"summary" : "Pterodactyl Wings vulnerable to improper isolation of server file access",
"details" : "### Impact\n\nThis vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible.\n\nIn order to use this exploit, an attacker must have an existing \"server\" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC.\n\n### Resolution\n\nIn order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. While tests were written to ensure security and functionality, there may be some semantic differences of certain operations, such as different errors being returned for example. If you notice any major semantic differences, please open an issue on our issue tracker so it can be resolved. <https://github.com/pterodactyl/panel/issues/new/choose>\n\n### Patches\n\nThis vulnerability has been resolved in version `v1.11.9` of Wings.\n\nEveryone should update to Wings `v1.11.9` (or newer).\n\n### Workarounds\n\nNone.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/pterodactyl/wings"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.11.9"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-27102"
}, {
"type" : "WEB",
"url" : "https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pterodactyl/wings"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-362", "CWE-363" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2024-03-15T16:48:21Z",
"nvd_published_at" : "2024-03-13T21:15:59Z"
}
}