Pterodactyl Wings Missing Authorization Check Vulnerability Allows Cross-Node Server Data Access

A vulnerability in Pterodactyl Wings prior to version 1.12.1 allows users with a node secret token to access information about any server on the instance, regardless of node association. This issue arises from a lack of authorization checks, enabling authenticated Wings nodes to retrieve server installation scripts and manipulate the installation and transfer statuses of servers on other nodes. The vulnerability requires access to a Wings secret access token, which can be obtained from the node's configuration file.

Impact

Exploitation of this vulnerability allows access to sensitive server configuration data across the Pterodactyl panel, regardless of node ownership. This could lead to unauthorized manipulation of server data, including causing permanent data loss by falsely indicating a server transfer was successful.

Remediation

Users are advised to upgrade to Pterodactyl Wings version 1.12.1.