GHSA-5822-pw57-vv37 XSS vulnerability when listing users on add & modify server pages.

Not scored Published 8 Oct 2020

An XSS vulnerability in Pterodactyl Panel allows attackers to inject scripts via account names in admin server pages, potentially compromising admin accounts.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-5822-pw57-vv37?

GHSA-5822-pw57-vv37 is a cross-site scripting vulnerability in pterodactyl/panel, published on 8 Oct 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Impact

An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.

Patches

This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.

Workarounds

No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.

For more information

If you have any questions or comments about this advisory please reach out on Discord, or by emailing dane at pterodactyl dot io.

Thank you to Sergej for the responsible disclosure of this issue.

Which versions are affected by GHSA-5822-pw57-vv37?

4 open source packages ship an affected version, including pterodactyl/panel.

Package	Affected	Fixed in
`pterodactyl/panel` Packagist	All versions	`0.7.19`
`pterodactyl/panel` Packagist	All versions	`0.7.19`
`pterodactyl/panel` Packagist	From `1.0.0-rc.0`	`1.0.0-rc.7`
`pterodactyl/panel` Packagist	From `1.0.0-rc.0`	`1.0.0-rc.7`

How do I fix GHSA-5822-pw57-vv37?

Upgrade pterodactyl/panel to a fixed version for your release line: 0.7.19 or 1.0.0-rc.7.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-5822-pw57-vv37 being exploited?

There is no known exploitation of GHSA-5822-pw57-vv37 in the wild and no public exploit code.