Description
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pterodactyl panel
Default version status: unaffected
0 to < 1.14.1affected1.14.1unaffected
pkg:github/pterodactyl/panelReferences
- https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6 ↗
- https://github.com/geo-chen/oss/blob/main/panel.md ↗
- https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php#L10-L25 ↗
- https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.php#L60-L75 ↗
- https://github.com/pterodactyl/panel/releases/tag/v1.14.1 ↗
- https://github.com/pterodactyl/panel ↗
- https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasks ↗