Pterodactyl Wings JWT Improper Scoping Vulnerability (CVE-2024-5493) - Unauthorized File Upload

Vulnerability Overview Title: Improper JWT scoping allows subuser to upload files when not explicitly granted "file.create" permissions Description: A privilege escalation vulnerability exists in Wings' endpoint due to insufficient validation when verifying panel-signed JWTs. Wings accepts any valid panel-signed JWT containing , , and , regardless of the token's intended purpose. Since the Panel issues JWTs with identical claims for other low-privilege operations such as WebSocket authentication and file downloads, an authenticated subuser can leverage one of these tokens to upload arbitrary files without possessing the required permission. Affected Versions Affected Versions: - : <1.12.2 - : <1.12.3 Fixed Versions: - : 1.12.2 - : 1.12.3 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: High - Availability: High CVE ID: CVE-2024-5493 Remediation Update Instructions: - Update to version 1.12.2 or later. - Update to version 1.12.3 or later. POC Code Detailed Analysis Vulnerability Details: - The Panel generates JWT tokens for various purposes, including: - - - - Exploitation Method: - Create a new subuser with minimal permissions on the server (e.g., ). - As the subuser, retrieve the WebSocket JWT token from the endpoint. - Manually resend the WebSocket request in the browser console to obtain a new, non-expired token. - Use this WebSocket token to directly call the endpoint instead of relying on WebSocket authentication. Observations: - Even if the subuser has never been granted the permission, they are able to write arbitrary files on the server. - This pattern occurs in several other operations, but this instance is particularly noteworthy.

Goal Reached Thanks to every supporter — we hit 100%!

Pterodactyl Wings JWT Improper Scoping Vulnerability (CVE-2024-5493) - Unauthorized File Upload

More from this source