Document Control

Contents

1. Executive Summary

Assessment outcome

Testing against panel.pterodactyl.htb identified one critical unauthenticated vulnerability and a chained two-stage privilege escalation reaching root. Full host compromise was achieved from an unauthenticated starting position.

CVE-2025-49132 is a path traversal vulnerability in Pterodactyl Panel versions below v1.11.11 that permits unauthenticated disclosure of the application configuration file via the locale endpoint. The leaked configuration contained the Laravel APP_KEY and database credentials. Database access was used to extract and crack a user password hash, providing SSH access to the host.

From the SSH session, privilege escalation chained two kernel- and library-level vulnerabilities. CVE-2025-6018 exploits PAM's user_readenv=1 configuration with a manipulated ~/.pam_environment to inject environment variables that trick pam_systemd into registering the session as a local graphical session. This granted polkit allow_active permissions including UDisks2 filesystem operations.

CVE-2025-6019 abuses a race condition in libblockdev's bd_fs_resize(), which temporarily mounts XFS filesystems without nosuid or nodev. A SUID binary embedded in a crafted XFS image executes with root privileges during the mount window, producing a SUID root shell.

Impact

An attacker in the same position obtains an unauthenticated read of application secrets, then root access to the host through two independently actionable privilege escalation vulnerabilities. All data, credentials and configuration on the host are exposed.

Priority recommendations

1. Upgrade Pterodactyl Panel to v1.11.11 or later to patch CVE-2025-49132.
2. Apply available patches for CVE-2025-6018 in the PAM package and disable user_readenv=1 where not required.
3. Apply available patches for CVE-2025-6019 in libblockdev / UDisks2 and restrict polkit UDisks2 filesystem operations to trusted sessions only.

2. Assessment Scope and Methodology

2.1 Target and observed services

nmap -sV -sC -p- <TARGET_IP>

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6
80/tcp open  http    nginx 1.21.5

Port 80 redirects to pterodactyl.htb. Subdomain fuzzing revealed panel.pterodactyl.htb. Both added to /etc/hosts before proceeding.

2.2 Approach

Testing started with service discovery and virtual host enumeration. The Pterodactyl Panel was identified and its version fingerprinted against known CVEs. The CVE-2025-49132 path traversal was exploited to read the configuration file and extract database credentials. The database was accessed to recover a password hash. After SSH access, the PAM version was identified and the polkit session manipulation was tested. The XFS image was prepared on the attacker machine and the race condition exploit was run on the target.

ffuf -u http://pterodactyl.htb -H 'Host: FUZZ.pterodactyl.htb' -w subdomains.txt -ac

panel    [Status: 200]

2.3 Severity classification

3. Results Overview

3.1 Findings summary

3.2 Compromise sequence

3.3 Relationship between findings

F-01 provides the initial foothold; without it, the SSH session in stage 02 cannot be established. F-02 and F-03 form a chained local privilege escalation: F-02 is a prerequisite for the polkit operations used in F-03. F-02 alone does not yield root but is required to enable F-03.

5. Remediation and Assessment Closeout

5.1 Corrective action plan

No remediation retest is documented. Each finding includes verification criteria for closure.

5.2 Test artefacts

5.3 Evidence and limitations

Evidence blocks are sourced from the Pterodactyl assessment walkthrough. Flag values and cracked passwords are omitted from all evidence. The assessment did not perform exhaustive subdomain enumeration beyond the discovered panel subdomain.

5.4 Evidence index