x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2024-34068

[GoVulnBot]

CVE-2024-34068 references github.com/pterodactyl/wings, which may be a Go module.

Description:
Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This issue has been addressed in version 1.11.2 and users are advised to upgrade. Users unable to upgrade may enable the api.disable_remote_download option as a workaround.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-34068
• JSON: https://github.com/CVEProject/cvelist/tree/9dd19dd18cc63cca2d2b5574c051c436a40e6d98/2024/34xxx/CVE-2024-34068.json
• advisory: GHSA-qq22-jj8x-4wwv
• advisory: GHSA-6rg3-8h8x-5xfv
• fix: pterodactyl/wings@c152e36
• Imported by: https://pkg.go.dev/github.com/pterodactyl/wings?tab=importedby

Cross references:

• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: GHSA-6rg3-8h8x-5xfv #389 EFFECTIVELY_PRIVATE
• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2021-32699, GHSA-jj6m-r8jc-2gp7 #919 NOT_IMPORTABLE
• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: GHSA-p8r3-83r8-jwj5 #1542 EFFECTIVELY_PRIVATE
• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2023-25168 #1555 EFFECTIVELY_PRIVATE
• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2023-32080 #1768 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/pterodactyl/wings
      vulnerable_at: 1.11.12
      packages:
        - package: wings
summary: CVE-2024-34068 in github.com/pterodactyl/wings
cves:
    - CVE-2024-34068
references:
    - advisory: https://github.com/pterodactyl/wings/security/advisories/GHSA-qq22-jj8x-4wwv
    - advisory: https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv
    - fix: https://github.com/pterodactyl/wings/commit/c152e36101aba45d8868a9a0eeb890995e8934b8
source:
    id: CVE-2024-34068

[gopherbot]

Change https://go.dev/cl/586484 mentions this issue: data/reports: add 73 unreviewed reports