Wings vulnerable to escape to host from installation container

CVE-2023-32080

What is CVE-2023-32080?

Wings, the server control plane for Pterodactyl Panel, contains a vulnerability that affects users running versions prior to 1.7.5 and 1.11.0 before 1.11.6. This flaw allows attackers with the ability to modify install scripts or execute user-supplied code to gain access to the host system running Wings. Upgrading to version 1.11.6 or 1.7.5 is crucial, as this vulnerability empowers malicious users who can exploit compromised administrator accounts on the Panel. Although using a rootless container runtime may provide some mitigation, most users operate with container runtimes running as root, increasing risk. Considering SELinux may limit some operations, privileged containers still possess significant freedom, which exacerbates the potential for exploitation.

References