CVE-2024-34068

Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This issue has been addressed in version 1.11.2 and users are advised to upgrade. Users unable to upgrade may enable the `api.disable_remote_download` option as a workaround.

• CWE-284
• CWE-441
• CWE-918

• https://github.com/pterodactyl/wings/commit/c152e36101aba45d8868a9a0eeb890995e8934b8Patch
• https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfvRelated
• https://github.com/pterodactyl/wings/security/advisories/GHSA-qq22-jj8x-4wwvMitigation, Patch, Vendor Advisory
• https://github.com/pterodactyl/wings/commit/c152e36101aba45d8868a9a0eeb890995e8934b8Patch
• https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfvRelated
• https://github.com/pterodactyl/wings/security/advisories/GHSA-qq22-jj8x-4wwvMitigation, Patch, Vendor Advisory

Published

May 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34062tqdm is an open source progress bar for Python and CLI. Any …4.8
• CVE-2024-34063vodozemac is an implementation of Olm and Megolm in pure Rus…2.5
• CVE-2024-34064Jinja is an extensible templating engine. The `xmlattr` filt…5.4
• CVE-2024-34065Strapi is an open-source content management system. By combi…8.1
• CVE-2024-34066Pterodactyl wings is the server control plane for Pterodacty…8.4
• CVE-2024-34067Pterodactyl is a free, open-source game server management pa…6.1
• CVE-2024-34069Werkzeug is a comprehensive WSGI web application library. Th…7.5
• CVE-2024-3407The WP Prayer WordPress plugin through 2.0.9 does not have C…5.3
• CVE-2024-34070Froxlor is open source server administration software. Prior…9.6
• CVE-2024-34071Umbraco is an ASP.NET CMS used by more than 730.000 websites…6.1
• CVE-2024-34072sagemaker-python-sdk is a library for training and deploying…7.8
• CVE-2024-34073sagemaker-python-sdk is a library for training and deploying…7.8