CVE-2024-34066 json
Arbitrary File Write/Read in Pterodactyl wings
published 2y ago modified 2mo ago also EUVD-2024-1631 , GHSA-gqmf-jqgv-v8fw , GO-2024-2814
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.
Patch / fix
- go github.com/pterodactyl/wings 1.11.12
- pterodactyl wings 1.11.12
Is CVE-2024-34066 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2y ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/pterodactyl/wings | <1.11.12 |
1.11.12 |
Affected products
- pterodactyl wings
Classification
- Weakness
-
- CWE-552 Files or Directories Accessible to External Parties
References
-
github.com
/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de
web, patch
-
github.com
/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fw
web, mitigation, patch, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-34066
advisory
-
github.com
/pterodactyl/wings
package
Sources
- CVE List CVE-2024-34066
- GitHub Advisory GHSA-gqmf-jqgv-v8fw
- NVD CVE-2024-34066
- OSV GO-2024-2814
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.