CVE-2021-41273

Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.

Pterodactyl es un panel de administración de servidores de juegos de código abierto construido con PHP 7, React y Go. Debido a protecciones de tipo CSRF configuradas inapropiadamente en dos rutas, un usuario malicioso podría ejecutar un ataque basado en CSRF contra los siguientes endpoints: Envío de un correo electrónico de prueba y Generación de un token de autodespliegue de nodo. En ningún momento se expondría ningún dato al usuario malicioso, esto simplemente desencadenaría el envío de correo electrónico a un usuario administrativo, o generaría un único token de auto-despliegue de forma inesperada. Este token no se revela al usuario malicioso, simplemente se crea inesperadamente en el sistema. Esto se ha abordado en la versión "1.6.6". Los usuarios pueden aplicar manualmente las correcciones publicadas en la versión v1.6.6 para parchear sus propios sistemas.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-09-15 CVE Reserved
2021-11-17 CVE Published
2023-06-10 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5	2021-11-24
https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6	2021-11-24

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pterodactyl Search vendor "Pterodactyl"		Panel Search vendor "Pterodactyl" for product "Panel"				< 1.6.6 Search vendor "Pterodactyl" for product "Panel" and version " < 1.6.6"		-		Affected