Listen to this Post
The vulnerability in Pterodactyl arises from the Wings daemon’s handling of SFTP connections for server file access. When a user initiates an SFTP session, Wings authenticates the user by making an API call to the Panel to verify permissions and credentials. This authentication occurs only during the initial connection handshake. Once established, the SFTP session remains active without subsequent permission checks or re-validation. Consequently, if an administrator modifies the user’s permissions or removes them from the server via the Panel, any active SFTP sessions held by that user are not terminated or updated. The user retains the same level of access through the existing session until they voluntarily disconnect or the Wings service is restarted. This flaw stems from insufficient session expiration mechanisms, where session credentials persist despite permission changes. The vulnerability is confined to the SFTP subsystem and does not expose Wings private data or files outside the server’s filesystem. Exploitation requires the user to be actively connected at the time of permission revocation; if disconnected, they cannot reconnect with reduced permissions. This allows unauthorized persistence and file access, undermining the intended security model. The issue is mitigated by the need for an existing connection, but it poses a risk in scenarios where users are removed due to security incidents, as they may maintain access indefinitely until session closure.
Platform: Pterodactyl
Version: Pre-1.12.0
Vulnerability: SFTP session persistence
Severity: Medium
date: Not disclosed
Prediction: Patched in 1.12.0
What Undercode Say:
Analytics
bash commands:
- systemctl status wings
- journalctl -u wings
- netstat -tan ESTABLISHED
- lsof -i :2022
- ps aux grep sftp
How Exploit:
- Establish SFTP connection.
- Permissions revoked meanwhile.
- Continue file access.
Protection from this CVE
- Upgrade to 1.12.0.
- Restart Wings service.
- Monitor active sessions.
Impact:
- Unauthorized file access.
- Bypass permission changes.
- Data leakage risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
