CVE-2024-34066: Insufficient Information (NVD-CWE-noinfo)
value: Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-03T18:15Z
Repository: https://github.com/pterodactyl/wings
Language: Go
Files changed: config/config.go
Commit date: 2024-04-10 15:27:54 -0600
Commit message: config: prevent programmatic updates to specific fields

Diff: diff --git a/config/config.go b/config/config.go
index 67654c4e..37701152 100644
--- a/config/config.go
+++ b/config/config.go
@@ -87,11 +87,11 @@ type ApiConfiguration struct {
 	}
 
 	// Determines if functionality for allowing remote download of files into server directories
 	// is enabled on this instance. If set to "true" remote downloads will not be possible for
 	// servers.
-	DisableRemoteDownload bool `json:"disable_remote_download" yaml:"disable_remote_download"`
+	DisableRemoteDownload bool `json:"-" yaml:"disable_remote_download"`
 
 	// The maximum size for files uploaded through the Panel in MB.
 	UploadLimit int64 `default:"100" json:"upload_limit" yaml:"upload_limit"`
 
 	// A list of IP address of proxies that may send a X-Forwarded-For header to set the true clients IP
@@ -121,27 +121,27 @@ type RemoteQueryConfiguration struct {
 }
 
 // SystemConfiguration defines basic system configuration settings.
 type SystemConfiguration struct {
 	// The root directory where all of the pterodactyl data is stored at.
-	RootDirectory string `default:"/var/lib/pterodactyl" yaml:"root_directory"`
+	RootDirectory string `default:"/var/lib/pterodactyl" json:"-" yaml:"root_directory"`
 
 	// Directory where logs for server installations and other wings events are logged.
-	LogDirectory string `default:"/var/log/pterodactyl" yaml:"log_directory"`
+	LogDirectory string `default:"/var/log/pterodactyl" json:"-" yaml:"log_directory"`
 
 	// Directory where the server data is stored at.
-	Data string `default:"/var/lib/pterodactyl/volumes" yaml:"data"`
+	Data string `default:"/var/lib/pterodactyl/volumes" json:"-" yaml:"data"`
 
 	// Directory where server archives for transferring will be stored.
-	ArchiveDirectory string `default:"/var/lib/pterodactyl/archives" yaml:"archive_directory"`
+	ArchiveDirectory string `default:"/var/lib/pterodactyl/archives" json:"-" yaml:"archive_directory"`
 
 	// Directory where local backups will be stored on the machine.
-	BackupDirectory string `default:"/var/lib/pterodactyl/backups" yaml:"backup_directory"`
+	BackupDirectory string `default:"/var/lib/pterodactyl/backups" json:"-" yaml:"backup_directory"`
 
 	// TmpDirectory specifies where temporary files for Pterodactyl installation processes
 	// should be created. This supports environments running docker-in-docker.
-	TmpDirectory string `default:"/tmp/pterodactyl" yaml:"tmp_directory"`
+	TmpDirectory string `default:"/tmp/pterodactyl" json:"-" yaml:"tmp_directory"`
 
 	// The user that should own all of the server files, and be used for containers.
 	Username string `default:"pterodactyl" yaml:"username"`
 
 	// The timezone for this Wings instance. This is detected by Wings automatically if possible,
@@ -304,11 +304,11 @@ type Configuration struct {
 	// someone from running an endless loop that spams data to logs.
 	Throttles ConsoleThrottles
 
 	// The location where the panel is running that this daemon should connect to
 	// to collect data and send events.
-	PanelLocation string                   `json:"remote" yaml:"remote"`
+	PanelLocation string                   `json:"-" yaml:"remote"`
 	RemoteQuery   RemoteQueryConfiguration `json:"remote_query" yaml:"remote_query"`
 
 	// AllowedMounts is a list of allowed host-system mount points.
 	// This is required to have the "Server Mounts" feature work properly.
 	AllowedMounts []string `json:"-" yaml:"allowed_mounts"`
@@ -674,12 +674,14 @@ func getSystemName() (string, error) {
 		return "", err
 	}
 	return release["ID"], nil
 }
 
-var openat2 atomic.Bool
-var openat2Set atomic.Bool
+var (
+	openat2    atomic.Bool
+	openat2Set atomic.Bool
+)
 
 func UseOpenat2() bool {
 	if openat2Set.Load() {
 		return openat2.Load()
 	}

Vulnerable code: 	DisableRemoteDownload bool `json:"disable_remote_download" yaml:"disable_remote_download"`
	RootDirectory string `default:"/var/lib/pterodactyl" yaml:"root_directory"`
	LogDirectory string `default:"/var/log/pterodactyl" yaml:"log_directory"`
	Data string `default:"/var/lib/pterodactyl/volumes" yaml:"data"`
	ArchiveDirectory string `default:"/var/lib/pterodactyl/archives" yaml:"archive_directory"`
	BackupDirectory string `default:"/var/lib/pterodactyl/backups" yaml:"backup_directory"`
	TmpDirectory string `default:"/tmp/pterodactyl" yaml:"tmp_directory"`
	PanelLocation string                   `json:"remote" yaml:"remote"`
var openat2 atomic.Bool
var openat2Set atomic.Bool
Fixed code: 	DisableRemoteDownload bool `json:"-" yaml:"disable_remote_download"`
	RootDirectory string `default:"/var/lib/pterodactyl" json:"-" yaml:"root_directory"`
	LogDirectory string `default:"/var/log/pterodactyl" json:"-" yaml:"log_directory"`
	Data string `default:"/var/lib/pterodactyl/volumes" json:"-" yaml:"data"`
	ArchiveDirectory string `default:"/var/lib/pterodactyl/archives" json:"-" yaml:"archive_directory"`
	BackupDirectory string `default:"/var/lib/pterodactyl/backups" json:"-" yaml:"backup_directory"`
	TmpDirectory string `default:"/tmp/pterodactyl" json:"-" yaml:"tmp_directory"`
	PanelLocation string                   `json:"-" yaml:"remote"`
var (
	openat2    atomic.Bool
	openat2Set atomic.Bool
)