x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2023-25168

[GoVulnBot]

CVE-2023-25168 references github.com/pterodactyl/wings, which may be a Go module.

Description:
Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version v1.11.4 of Wings, and has been back-ported to the 1.7 release series in v1.7.4. Anyone running v1.11.x should upgrade to v1.11.4 and anyone running v1.7.x should upgrade to v1.7.4. There are no known workarounds for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-25168
• JSON: https://github.com/CVEProject/cvelist/tree/99c7ae4f8a039581dda585e035f3a08c78784394/2023/25xxx/CVE-2023-25168.json
• web: GHSA-p8r3-83r8-jwj5
• web: GHSA-66p8-j459-rq63
• fix: pterodactyl/wings@429ac62
• Imported by: https://pkg.go.dev/github.com/pterodactyl/wings?tab=importedby

Cross references:

• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: GHSA-6rg3-8h8x-5xfv #389 EFFECTIVELY_PRIVATE
• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2021-32699, GHSA-jj6m-r8jc-2gp7 #919 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/pterodactyl/wings
    packages:
      - package: wings
description: |
    Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue.
cves:
  - CVE-2023-25168
references:
  - web: https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5
  - web: https://github.com/pterodactyl/wings/security/advisories/GHSA-66p8-j459-rq63
  - fix: https://github.com/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d

[tatianab]

Duplicate of #1542

[gopherbot]

Change https://go.dev/cl/467396 mentions this issue: data/excluded: batch add excluded reports

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606782 mentions this issue: data/reports: unexclude 20 reports (2)