CVE-2023-25152 (Go, published 2023-02-08T19:15Z)
Description: value: Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on the target machine.   In order to use this exploit, an attacker must have an existing "server" allocated and controlled by the Wings Daemon. This vulnerability has been resolved in version `v1.11.3` of the Wings Daemon, and has been back-ported to the 1.7 release series in `v1.7.3`. Anyone running `v1.11.x` should upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`. There are no known workarounds for this vulnerability.

### Workarounds

None at this time.  




Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/pterodactyl/wings
Files changed:
server/filesystem/filesystem.go
server/filesystem/path.go
server/filesystem/path_test.go
Commit message: server(filesystem): SafePath tweaks


Vulnerable code:
	return fs.Chown(cleaned)
	if err := os.Chown(cleaned, uid, gid); err != nil {
	if st, err := os.Stat(cleaned); err != nil || !st.IsDir() {
	err = godirwalk.Walk(cleaned, &godirwalk.Options{

	var nonExistentPathResolution string

		// The requested directory doesn't exist, so at this point we need to iterate up the
		// path chain until we hit a directory that _does_ exist and can be validated.
		parts := strings.Split(filepath.Dir(r), "/")

		var try string
		// Range over all of the path parts and form directory pathings from the end
		// moving up until we have a valid resolution or we run out of paths to try.
		for k := range parts {
			try = strings.Join(parts[:(len(parts)-k)], "/")

			if !fs.unsafeIsInDataDirectory(try) {
				break
			}

			t, err := filepath.EvalSymlinks(try)
			if err == nil {
				nonExistentPathResolution = t
				break
			}
		}
	}

	// If the new path doesn't start with their root directory there is clearly an escape
	// attempt going on, and we should NOT resolve this path for them.
	if nonExistentPathResolution != "" {
		if !fs.unsafeIsInDataDirectory(nonExistentPathResolution) {
			return "", NewBadPathResolution(p, nonExistentPathResolution)

		// If the nonExistentPathResolution variable is not empty then the initial path requested
		// did not exist and we looped through the pathway until we found a match. At this point
		// we've confirmed the first matched pathway exists in the root server directory, so we
		// can go ahead and just return the path that was requested initially.
		return r, nil
		return ep, nil

Fixed code:
	return fs.unsafeChown(cleaned)
	return fs.unsafeChown(cleaned)
}
// unsafeChown chowns the given path, without checking if the path is safe. This should only be used
// when the path has already been checked.
func (fs *Filesystem) unsafeChown(path string) error {
	if err := os.Chown(path, uid, gid); err != nil {
	if st, err := os.Stat(path); err != nil || !st.IsDir() {
	err := godirwalk.Walk(path, &godirwalk.Options{
	iofs "io/fs"
		// The target of one of the symlinks (EvalSymlinks is recursive) does not exist.
		// So we get what target path does not exist and check if it's within the data
		// directory. If it is, we return the original path, otherwise we return an error.
		pErr, ok := err.(*iofs.PathError)
		if !ok {
			return "", errors.Wrap(err, "server/filesystem: failed to evaluate symlink")
		ep = pErr.Path
		// Returning the original path here instead of the resolved path ensures that
		// whatever the user is trying to do will work as expected. If we returned the
		// resolved path, the user would be unable to know that it is in fact a symlink.
		return r, nil
	if err := os.Symlink(filepath.Join(rfs.root, "malicious_does_not_exist.txt"), filepath.Join(rfs.root, "/server/symlinked_does_not_exist.txt")); err != nil {
		panic(err)
	}

	if err := os.Symlink(filepath.Join(rfs.root, "/server/symlinked_does_not_exist.txt"), filepath.Join(rfs.root, "/server/symlinked_does_not_exist2.txt")); err != nil {
		panic(err)
	}

		g.It("cannot write to a non-existent file symlinked outside the root", func() {
			r := bytes.NewReader([]byte("testing what the fuck"))

			err := fs.Writefile("symlinked_does_not_exist.txt", r)
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
		})

		g.It("cannot write to chained symlinks with target that does not exist outside the root", func() {
			r := bytes.NewReader([]byte("testing what the fuck"))

			err := fs.Writefile("symlinked_does_not_exist2.txt", r)
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
		})