CVE-2024-34068: 
NixOS vulnerability analysis and mitigation

Pterodactyl wings, the server control plane for Pterodactyl Panel, contains a vulnerability (CVE-2024-34068) that was discovered on May 3, 2024. The vulnerability affects versions prior to 1.11.12, where an authenticated user with game server access can bypass previously implemented access controls in the pull endpoint (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 Base Score of 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. It is associated with multiple CWE categories including CWE-918 (Server-Side Request Forgery), CWE-441 (Unintended Proxy or Intermediary), and CWE-284 (Improper Access Control). The issue specifically relates to the ability to bypass access control mechanisms that were previously implemented to prevent accessing internal endpoints of the node hosting Wings (NVD).

When exploited, this vulnerability allows malicious users to potentially access resources on local networks that would otherwise be inaccessible. The attack requires valid authentication credentials and therefore is not exploitable by unauthenticated users (GitHub Advisory).

The vulnerability requires an authenticated user with access to a game server to exploit. It has a network attack vector with low attack complexity and requires low privileges without any user interaction (GitHub Advisory).

The vulnerability has been addressed in version 1.11.12. Users are advised to upgrade to this version. For those unable to upgrade immediately, enabling the 'api.disable_remote_download' option serves as a temporary workaround (NVD, GitHub Advisory).