Vulnerability-Lookup

CVE-2024-49762 (GCVE-0-2024-49762)

Vulnerability from cvelistv5 – Published: 2024-10-24 21:39 – Updated: 2024-10-25 17:20

Title

Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Summary

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it's unlikely that their account swill be compromised by this vulnerability, it's not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data.

Severity ?

4.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-313 - Cleartext Storage in a File or on Disk

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pterodactyl/panel/security/adv…	x_refsource_CONFIRM
	https://github.com/pterodactyl/panel/commit/75b59…	x_refsource_MISC
	https://github.com/pterodactyl/panel/commit/8be2b…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pterodactyl	panel	Affected: < 1.11.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T17:20:24.295846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T17:20:35.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "panel",
          "vendor": "pterodactyl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it\u0027s unlikely that their account swill be compromised by this vulnerability, it\u0027s not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-313",
              "description": "CWE-313: Cleartext Storage in a File or on Disk",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-24T21:39:24.986Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr"
        },
        {
          "name": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4"
        },
        {
          "name": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1"
        }
      ],
      "source": {
        "advisory": "GHSA-c479-wq8g-57hr",
        "discovery": "UNKNOWN"
      },
      "title": "Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-49762",
    "datePublished": "2024-10-24T21:39:24.986Z",
    "dateReserved": "2024-10-18T13:43:23.456Z",
    "dateUpdated": "2024-10-25T17:20:35.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-25T17:20:24.295846Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-25T17:20:31.390Z\"}}], \"cna\": {\"title\": \"Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled\", \"source\": {\"advisory\": \"GHSA-c479-wq8g-57hr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"pterodactyl\", \"product\": \"panel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.11.8\"}]}], \"references\": [{\"url\": \"https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr\", \"name\": \"https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4\", \"name\": \"https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1\", \"name\": \"https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it\u0027s unlikely that their account swill be compromised by this vulnerability, it\u0027s not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-313\", \"description\": \"CWE-313: Cleartext Storage in a File or on Disk\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-10-24T21:39:24.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-25T17:20:35.873Z\", \"dateReserved\": \"2024-10-18T13:43:23.456Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-10-24T21:39:24.986Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-49762

Vulnerability from fkie_nvd - Published: 2024-10-24 22:15 - Updated: 2024-10-25 12:56

Severity ?

4.6 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
	security-advisories@github.com	https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
	security-advisories@github.com	https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it\u0027s unlikely that their account swill be compromised by this vulnerability, it\u0027s not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data."
    },
    {
      "lang": "es",
      "value": "Pterodactyl es un panel de administraci\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Cuando un usuario desactiva la autenticaci\u00f3n de dos factores a trav\u00e9s del Panel, se enviar\u00e1 una solicitud `DELETE` con su contrase\u00f1a actual en un par\u00e1metro de consulta. Si bien los par\u00e1metros de consulta se cifran cuando se usa TLS, muchos servidores web (incluidos los documentados oficialmente para su uso con Pterodactyl) registrar\u00e1n los par\u00e1metros de consulta en texto plano, almacenando la contrase\u00f1a de un usuario en texto plano. Antes de la versi\u00f3n 1.11.8, si un usuario malintencionado obtiene acceso a estos registros, podr\u00eda autenticarse contra la cuenta de un usuario; suponiendo que pueda descubrir la direcci\u00f3n de correo electr\u00f3nico o el nombre de usuario de la cuenta por separado. Este problema se ha corregido en la versi\u00f3n 1.11.8. No hay workarounds en este momento. No existe una vulnerabilidad directa dentro del software en lo que respecta a los registros generados por componentes intermedios como servidores web o servidores proxy de capa 7. Actualizar a `v1.11.8` o agregar el parche vinculado manualmente son las \u00fanicas formas de evitar este problema. Como esta vulnerabilidad est\u00e1 relacionada con el registro hist\u00f3rico de datos confidenciales, los usuarios que alguna vez hayan desactivado la autenticaci\u00f3n de dos factores en un panel (alojado por ellos mismos o gestionado por una empresa) deber\u00edan cambiar sus contrase\u00f1as y considerar la posibilidad de activar la autenticaci\u00f3n de dos factores si la dejaron desactivada. Si bien es poco probable que su cuenta se vea comprometida por esta vulnerabilidad, no es imposible. Los administradores del panel deber\u00edan considerar la posibilidad de borrar los registros de acceso que puedan contener datos confidenciales."
    }
  ],
  "id": "CVE-2024-49762",
  "lastModified": "2024-10-25T12:56:07.750",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-24T22:15:04.897",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-313"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-C479-WQ8G-57HR

Vulnerability from github – Published: 2024-10-24 19:07 – Updated: 2024-10-25 16:47

Summary

Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Details

Impact

When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text.

If a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately.

Patches

This problem has been patched by https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1 on the 1.0-develop branch and released under v1.11.8 as a single commit on top of v1.11.7 https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4

Patch file: https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1.patch

Workarounds

There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as webservers or Layer 7 proxies.

Updating to v1.11.8 or adding the linked patch manually are the only ways to avoid this problem.

User Notice

As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it's unlikely that your account will be compromised by this vulnerability, it's not impossible.

Panel administrators should consider clearing any access logs that may contain sensitive data, for Panels using NGINX, the access log is located at /var/log/nginx/pterodactyl.app-access.log.

Severity ?

4.6 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pterodactyl/panel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-49762"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-313"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-24T19:07:03Z",
    "nvd_published_at": "2024-10-24T22:15:04Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nWhen a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user\u0027s password in plain text.\n\nIf a malicious user obtains access to these logs they could *potentially* authenticate against a user\u0027s account; assuming they are able to discover the account\u0027s email address or username **separately**.\n\n### Patches\n\nThis problem has been patched by \u003chttps://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1\u003e on the `1.0-develop` branch and released under `v1.11.8` as a single commit on top of `v1.11.7` \u003chttps://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4\u003e\n\nPatch file: \u003chttps://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1.patch\u003e\n\n### Workarounds\n\nThere are no workarounds at this time.  There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as webservers or Layer 7 proxies.\n\nUpdating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem.\n\n### User Notice\n\nAs this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled.  While it\u0027s unlikely that your account will be compromised by this vulnerability, it\u0027s not impossible.\n\nPanel administrators should consider clearing any access logs that may contain sensitive data, for Panels using NGINX, the access log is located at `/var/log/nginx/pterodactyl.app-access.log`.",
  "id": "GHSA-c479-wq8g-57hr",
  "modified": "2024-10-25T16:47:19Z",
  "published": "2024-10-24T19:07:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49762"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pterodactyl/panel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-49762 (GCVE-0-2024-49762)

FKIE_CVE-2024-49762

GHSA-C479-WQ8G-57HR

Impact

Patches

Workarounds

User Notice

Tags

Sightings

Nomenclature