Pterodactyl vulnerabilities

A vulnerability in Pterodactyl causes a global login rate limit affecting all users. The limit is global, not per IP, allowing an attacker to block login for everyone by sending about 10 requests per minute.

A vulnerability in Pterodactyl allows an authenticated subuser to write arbitrary files to the server without the required permissions. A JWT token issued for other operations (e.g., WebSocket) can be reused for file uploads.

Vulnerability in Pterodactyl prior to version 1.12.3. A logic flaw in the Client API allows users to bypass database allocation limits due to a broken locking mechanism.

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. After sign-in, the token is not sufficiently marked as used, allowing an attacker who intercepted the token (e.g., during a screen share) to reuse it within the 60-second validity window along with known credentials. This is fixed in version 1.12.0.

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.