{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/pterodactyl/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":["Unauthorized Subuser"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pterodactyl Panel (\u003c 1.12.3)","Pterodactyl Wings (\u003c 1.12.2)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","vulnerability","JWT","Pterodactyl","web-server"],"_cs_type":"threat","_cs_vendors":["Pterodactyl"],"content_html":"\u003cp\u003eA significant privilege escalation vulnerability, tracked as CVE-2026-54593, affects Pterodactyl Panel versions prior to 1.12.3 and Pterodactyl Wings versions prior to 1.12.2. The flaw resides in the Wings \u003ccode\u003e/upload/file\u003c/code\u003e endpoint, which improperly validates panel-signed JSON Web Tokens (JWTs). Specifically, Wings accepts any valid JWT containing \u003ccode\u003eserver_uuid\u003c/code\u003e, \u003ccode\u003euser_uuid\u003c/code\u003e, and \u003ccode\u003eunique_id\u003c/code\u003e, irrespective of the token's intended purpose. This design flaw enables an authenticated subuser, even one with minimal permissions (e.g., only \u003ccode\u003ewebsocket.connect\u003c/code\u003e), to reuse a JWT issued for a lower-privilege operation (like WebSocket authentication or file downloads) to upload arbitrary files to the associated server. This bypasses the intended \u003ccode\u003efile.create\u003c/code\u003e permission checks, allowing unauthorized write access to the server's file system. This vulnerability affects anyone running vulnerable versions of the Pterodactyl game server management software.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated subuser gains minimal access to a Pterodactyl server, such as the ability to connect to the server's console (requiring \u003ccode\u003ewebsocket.connect\u003c/code\u003e permission).\u003c/li\u003e\n\u003cli\u003eThe subuser makes an API request to a legitimate low-privilege endpoint on the Pterodactyl Panel, such as \u003ccode\u003e/api/client/servers/[...]/websocket\u003c/code\u003e or a file download endpoint, to obtain a panel-signed JSON Web Token (JWT).\u003c/li\u003e\n\u003cli\u003eThe Pterodactyl Panel issues a JWT containing claims like \u003ccode\u003eserver_uuid\u003c/code\u003e, \u003ccode\u003euser_uuid\u003c/code\u003e, and \u003ccode\u003eunique_id\u003c/code\u003e, which are used for various operations across the Panel and Wings.\u003c/li\u003e\n\u003cli\u003eThe subuser intercepts and extracts this JWT.\u003c/li\u003e\n\u003cli\u003eThe subuser then crafts an HTTP POST request to the Pterodactyl Wings \u003ccode\u003e/upload/file\u003c/code\u003e endpoint, including the obtained JWT as a query parameter (\u003ccode\u003e?token=\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe subuser includes arbitrary file content within the POST request, intending to upload it to the server.\u003c/li\u003e\n\u003cli\u003eThe Pterodactyl Wings component, due to improper JWT scoping validation, accepts the JWT as valid for file upload, despite the token initially being issued for a different, lower-privilege action.\u003c/li\u003e\n\u003cli\u003eWings proceeds to write the arbitrary file content to the server's file system, achieving unauthorized file upload and privilege escalation for the subuser.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows any authenticated subuser, regardless of their specific permissions on a server, to upload arbitrary files to that server. While the attacker must already have subuser access to the target server, this flaw significantly escalates their privileges beyond what is explicitly granted, potentially leading to unauthorized data modification, execution of malicious scripts, or further system compromise. The impact is confined to the specific server the subuser has access to; users without any subuser access cannot exploit this vulnerability. The inability to properly control file uploads can lead to data integrity issues, denial of service through disk exhaustion, or remote code execution if the uploaded files are executed by vulnerable services on the server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-54593\u003c/strong\u003e: Upgrade Pterodactyl Panel to version 1.12.3 or newer, and Pterodactyl Wings to version 1.12.2 or newer immediately to mitigate CVE-2026-54593.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule\u003c/strong\u003e: Implement the provided Sigma rule in your SIEM to detect suspicious file upload attempts on the Pterodactyl Wings \u003ccode\u003e/upload/file\u003c/code\u003e endpoint. Tune this rule by identifying and allowlisting legitimate uses of this endpoint.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable webserver logging\u003c/strong\u003e: Ensure detailed webserver access logs are enabled for your Pterodactyl Wings instance to capture HTTP requests, including method, URI, query parameters, and status codes, which are crucial for detecting this activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T15:44:29Z","date_published":"2026-07-28T15:44:29Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pterodactyl-jwt-scoping/","summary":"A privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.","title":"Pterodactyl Wings Privilege Escalation via Improper JWT Scoping (CVE-2026-54593)","url":"https://feed.craftedsignal.io/briefs/2026-07-pterodactyl-jwt-scoping/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Panel (\u003e= 1.7.0, \u003c= 1.12.4)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","web-application","pterodactyl"],"_cs_type":"advisory","_cs_vendors":["Pterodactyl"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-61609, has been identified in Pterodactyl Panel versions 1.7.0 through 1.12.4. This flaw allows an unauthenticated attacker to trigger a panel-wide denial of service (DoS) by exploiting an improperly configured rate limiter on the login and two-factor authentication (2FA) checkpoint endpoints. The \u003ccode\u003eauthentication\u003c/code\u003e rate limiter, intended to prevent brute-force attacks, uses a single global bucket rather than keying per IP address or per account. This means a low-volume attacker, sending as few as 10 requests per minute from a single IP address, can exhaust this shared bucket. Once exhausted, all subsequent login and 2FA attempts by any user, from any IP address, will receive HTTP 429 \u0026quot;Too Many Requests\u0026quot; responses. This effectively locks out all legitimate users and administrators from accessing the panel, crippling its availability without requiring any prior authentication or complex attack techniques.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an internet-facing Pterodactyl panel running a vulnerable version (1.7.0-1.12.4).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts HTTP POST requests targeting the \u003ccode\u003e/auth/login/checkpoint\u003c/code\u003e or \u003ccode\u003e/auth/login\u003c/code\u003e endpoints.\u003c/li\u003e\n\u003cli\u003eFrom a single IP address, the attacker sends approximately 10 requests per minute to these authentication endpoints.\u003c/li\u003e\n\u003cli\u003eDue to the missing \u003ccode\u003e-\u0026gt;by($request-\u0026gt;ip())\u003c/code\u003e configuration in the \u003ccode\u003eRouteServiceProvider\u003c/code\u003e, the Pterodactyl panel increments a single, global rate-limit counter for all requests to these endpoints.\u003c/li\u003e\n\u003cli\u003eUpon the 11th request within a minute, the global rate limit is exceeded, causing the panel to return HTTP 429 \u0026quot;Too Many Requests\u0026quot; responses for all subsequent requests to \u003ccode\u003e/auth/login\u003c/code\u003e and \u003ccode\u003e/auth/login/checkpoint\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eLegitimate users, attempting to log in or complete 2FA, receive HTTP 429 responses regardless of their IP address or correct credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker sustains the low-volume rate of 10 requests per minute, perpetually locking out all users and administrators from accessing the Pterodactyl panel.\u003c/li\u003e\n\u003cli\u003eThe panel becomes entirely unusable for authentication, resulting in a sustained, unauthenticated, and panel-wide denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability poses a severe threat to the availability of affected Pterodactyl panels. An unauthenticated, low-bandwidth attacker can render any internet-facing panel inaccessible for all users, including administrators. The impact is a complete denial of service for authentication, meaning no one can log in or perform 2FA verification. This not only disrupts legitimate user access but also prevents administrators from managing the panel, potentially hindering incident response efforts or critical maintenance. The simplicity and low resource requirement for this attack make it highly attractive for adversaries seeking to cause disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-61609\u003c/strong\u003e: Immediately update Pterodactyl Panel to a version greater than 1.12.4, which includes the fix for CVE-2026-61609.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule\u003c/strong\u003e: Deploy the \u0026quot;Detect Pterodactyl Panel Global Rate-Limit DoS (CVE-2026-61609)\u0026quot; Sigma rule to your SIEM to detect attempts to exploit CVE-2026-61609 by monitoring webserver logs for HTTP 429 responses on authentication endpoints.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor webserver logs\u003c/strong\u003e: Actively monitor webserver logs for \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/auth/login\u003c/code\u003e and \u003ccode\u003e/auth/login/checkpoint\u003c/code\u003e that result in \u003ccode\u003esc-status: 429\u003c/code\u003e, especially from multiple distinct source IPs within a short timeframe, as described in the detection rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T15:02:20Z","date_published":"2026-07-28T15:02:20Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pterodactyl-dos/","summary":"An unauthenticated attacker can exploit CVE-2026-61609, a global rate-limit vulnerability in Pterodactyl Panel versions up to and including 1.12.4, by sending approximately 10 requests per minute to authentication endpoints, leading to a panel-wide denial of service for all legitimate users and administrators attempting to log in or complete 2FA.","title":"Pterodactyl Panel Global Rate-Limit Vulnerability Enables Unauthenticated DoS (CVE-2026-61609)","url":"https://feed.craftedsignal.io/briefs/2026-07-pterodactyl-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Pterodactyl","version":"https://jsonfeed.org/version/1.1"}