CVE-2024-49762

{"id": "CVE-2024-49762", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.5}]}, "published": "2024-10-24T22:15:04.897", "references": [{"url": "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4", "source": "security-advisories@github.com"}, {"url": "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1", "source": "security-advisories@github.com"}, {"url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-313"}]}], "descriptions": [{"lang": "en", "value": "Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately. This problem has been patched in version 1.11.8. There are no workarounds at this time. There is not a direct vulnerability within the software as it relates to logs generated by intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked patch manually are the only ways to avoid this problem. As this vulnerability relates to historical logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a company) should change their passwords and consider enabling 2FA if it was left disabled. While it's unlikely that their account swill be compromised by this vulnerability, it's not impossible. Panel administrators should consider clearing any access logs that may contain sensitive data."}, {"lang": "es", "value": "Pterodactyl es un panel de administraci\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Cuando un usuario desactiva la autenticaci\u00f3n de dos factores a trav\u00e9s del Panel, se enviar\u00e1 una solicitud `DELETE` con su contrase\u00f1a actual en un par\u00e1metro de consulta. Si bien los par\u00e1metros de consulta se cifran cuando se usa TLS, muchos servidores web (incluidos los documentados oficialmente para su uso con Pterodactyl) registrar\u00e1n los par\u00e1metros de consulta en texto plano, almacenando la contrase\u00f1a de un usuario en texto plano. Antes de la versi\u00f3n 1.11.8, si un usuario malintencionado obtiene acceso a estos registros, podr\u00eda autenticarse contra la cuenta de un usuario; suponiendo que pueda descubrir la direcci\u00f3n de correo electr\u00f3nico o el nombre de usuario de la cuenta por separado. Este problema se ha corregido en la versi\u00f3n 1.11.8. No hay workarounds en este momento. No existe una vulnerabilidad directa dentro del software en lo que respecta a los registros generados por componentes intermedios como servidores web o servidores proxy de capa 7. Actualizar a `v1.11.8` o agregar el parche vinculado manualmente son las \u00fanicas formas de evitar este problema. Como esta vulnerabilidad est\u00e1 relacionada con el registro hist\u00f3rico de datos confidenciales, los usuarios que alguna vez hayan desactivado la autenticaci\u00f3n de dos factores en un panel (alojado por ellos mismos o gestionado por una empresa) deber\u00edan cambiar sus contrase\u00f1as y considerar la posibilidad de activar la autenticaci\u00f3n de dos factores si la dejaron desactivada. Si bien es poco probable que su cuenta se vea comprometida por esta vulnerabilidad, no es imposible. Los administradores del panel deber\u00edan considerar la posibilidad de borrar los registros de acceso que puedan contener datos confidenciales."}], "lastModified": "2024-10-25T12:56:07.750", "sourceIdentifier": "security-advisories@github.com"}