CVE-2024-49762 (GCVE-0-2024-49762)
Vulnerability from cvelistv5
Published
2024-10-24 21:39
Modified
2024-10-25 17:20
Severity ?
4.6 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-313 - Cleartext Storage in a File or on Disk
Summary
Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it's unlikely that their account swill be compromised by this vulnerability, it's not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data.
References
Impacted products
Vendor Product Version
pterodactyl panel Version: < 1.11.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T17:20:24.295846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T17:20:35.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "panel",
          "vendor": "pterodactyl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it\u0027s unlikely that their account swill be compromised by this vulnerability, it\u0027s not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-313",
              "description": "CWE-313: Cleartext Storage in a File or on Disk",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-24T21:39:24.986Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr"
        },
        {
          "name": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4"
        },
        {
          "name": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1"
        }
      ],
      "source": {
        "advisory": "GHSA-c479-wq8g-57hr",
        "discovery": "UNKNOWN"
      },
      "title": "Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-49762",
    "datePublished": "2024-10-24T21:39:24.986Z",
    "dateReserved": "2024-10-18T13:43:23.456Z",
    "dateUpdated": "2024-10-25T17:20:35.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49762\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-10-24T22:15:04.897\",\"lastModified\":\"2024-10-25T12:56:07.750\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it\u0027s unlikely that their account swill be compromised by this vulnerability, it\u0027s not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data.\"},{\"lang\":\"es\",\"value\":\"Pterodactyl es un panel de administraci\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Cuando un usuario desactiva la autenticaci\u00f3n de dos factores a trav\u00e9s del Panel, se enviar\u00e1 una solicitud `DELETE` con su contrase\u00f1a actual en un par\u00e1metro de consulta. Si bien los par\u00e1metros de consulta se cifran cuando se usa TLS, muchos servidores web (incluidos los documentados oficialmente para su uso con Pterodactyl) registrar\u00e1n los par\u00e1metros de consulta en texto plano, almacenando la contrase\u00f1a de un usuario en texto plano. Antes de la versi\u00f3n 1.11.8, si un usuario malintencionado obtiene acceso a estos registros, podr\u00eda autenticarse contra la cuenta de un usuario; suponiendo que pueda descubrir la direcci\u00f3n de correo electr\u00f3nico o el nombre de usuario de la cuenta por separado. Este problema se ha corregido en la versi\u00f3n 1.11.8. No hay workarounds en este momento. No existe una vulnerabilidad directa dentro del software en lo que respecta a los registros generados por componentes intermedios como servidores web o servidores proxy de capa 7. Actualizar a `v1.11.8` o agregar el parche vinculado manualmente son las \u00fanicas formas de evitar este problema. Como esta vulnerabilidad est\u00e1 relacionada con el registro hist\u00f3rico de datos confidenciales, los usuarios que alguna vez hayan desactivado la autenticaci\u00f3n de dos factores en un panel (alojado por ellos mismos o gestionado por una empresa) deber\u00edan cambiar sus contrase\u00f1as y considerar la posibilidad de activar la autenticaci\u00f3n de dos factores si la dejaron desactivada. Si bien es poco probable que su cuenta se vea comprometida por esta vulnerabilidad, no es imposible. Los administradores del panel deber\u00edan considerar la posibilidad de borrar los registros de acceso que puedan contener datos confidenciales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.5,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-313\"}]}],\"references\":[{\"url\":\"https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-25T17:20:24.295846Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-25T17:20:31.390Z\"}}], \"cna\": {\"title\": \"Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled\", \"source\": {\"advisory\": \"GHSA-c479-wq8g-57hr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"pterodactyl\", \"product\": \"panel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.11.8\"}]}], \"references\": [{\"url\": \"https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr\", \"name\": \"https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4\", \"name\": \"https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1\", \"name\": \"https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it\u0027s unlikely that their account swill be compromised by this vulnerability, it\u0027s not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-313\", \"description\": \"CWE-313: Cleartext Storage in a File or on Disk\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-10-24T21:39:24.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-25T17:20:35.873Z\", \"dateReserved\": \"2024-10-18T13:43:23.456Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-10-24T21:39:24.986Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.