| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/pterodactyl/wings | ≥ 1.11.9, < 1.12.2 | 1.12.2 |
In wings/internal/ufs/fs_unix.go (line 92-94), this function is defined and is used to change permissions of files in the server:
func (fs *UnixFS) fchmodat(op string, dirfd int, name string, mode FileMode) error {
return ensurePathError(unix.Fchmodat(dirfd, name, uint32(mode), 0), op, name)
}
This call to the unix function fchmodat(int fd, char* name, mode_t mode, int flags) does not have the flag AT_SYMLINK_NOFOLLOW set, and Wings neither checks or validate if the target file is a symlink. This allows one to change permissions of files or folders outside of the server container by making symlinks to existing files in the host and then chmoding it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free