Detections
Analytics
SCA: security update for github.com/pterodactyl/wings (GHSA-p744-4q6p-hvc2)
high Tenable Self-Hosted Container Security Plugin ID 417359
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5
and versions 1.11.0 prior to 1.11.6 impacts anyone running the affected versions of Wings. This
vulnerability can be used to gain access to the host system running Wings if a user is able to modify an
server's install script or the install script executes code supplied by the user (either through
environment variables, or commands that execute commands based off of user data). This vulnerability has
been resolved in version `v1.11.6` of Wings, and has been back-ported to the 1.7 release series in
`v1.7.5`. Anyone running `v1.11.x` should upgrade to `v1.11.6` and anyone running `v1.7.x` should upgrade
to `v1.7.5`. There are no workarounds aside from upgrading. Running Wings with a rootless container
runtime may mitigate the severity of any attacks, however the majority of users are using container
runtimes that run as root as per the Wings documentation. SELinux may prevent attackers from performing
certain operations against the host system, however privileged containers have a lot of freedom even on
systems with SELinux enabled. It should be noted that this was a known attack vector, for attackers to
easily exploit this attack it would require compromising an administrator account on a Panel. However,
certain eggs (the data structure that holds the install scripts that get passed to Wings) have an issue
where they are unknowingly executing shell commands with escalated privileges provided by untrusted user
data. (CVE-2023-32080)
See Also
Plugin Details
Severity: High
ID: 417359
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.58
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2023-32080
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/11/2023
Vulnerability Publication Date: 5/10/2023
Reference Information
CVE: CVE-2023-32080
cwe: CWE-250