kerburenthusiasm/cve-2025-49132-pocProof-of-concept exploit for CVE-2025-49132 enabling unauthenticated remote code execution in Pterodactyl Panel <= 1.11.10 via locale parameter injection. Includes check and exploit modes.
Proof-of-Concept for CVE-2025-49132 for Remote Code Execution in Pterodactyl Panel <= 1.11.10
This PoC takes references from
# Check if the web application is vulnerable
python3 poc.py -u <url> -m check
# Do something funny
python3 poc.py -u <url> -m exploit -p <path_to_pear_dir> -t <path_to_write_to>
Analyzing the git diff of LocaleController.php between v1.11.10 and v1.11.11 (link), we can see that the controller accepts locale and namespace parameters without any validation or sanitization.
To understand why this is dangerous, we will look at the routing configured in panel/routes/base.php. The route explicitly removes authentication-related middleware, allowing unauthenticated users to call /locales/locale.json and supply the required query parameters such as locale and namespace. This means that these parameters are now controlled by the user.
Route::get('/locales/locale.json', Base\LocaleController::class)
// Remove authentication middleware for this endpoint
->withoutMiddleware(['auth', RequireTwoFactorAuthentication::class]);
Moving back to LocalController.php, the following line of code provides the RCE magic.
$this->loader->load($locale, str_replace('.', '/', $namespace))
The load function comes from Laravel's translation framework (here):
public function load($locale, $group, $namespace = null) # 1
{
if ($group === '*' && $namespace === '*') { # 2
return $this->loadJsonPaths($locale);
}
if (is_null($namespace) || $namespace === '*') { # 3
return $this->loadPaths($this->paths, $locale, $group); # 4
}
return $this->loadNamespaced($locale, $group, $namespace);
}
load function takes 3 arguments. Although confusing at first, the value str_replace('.', '/', $namespace) is actually passed to the second argument $group.$namespace will never be * since it will always be NULL. Similarly $group will never be * since we can control what is being passed here.$namespace is null, the branch will be taken resulting in the execution of loadPaths in #4.Understanding the above, we move to analyzing loadPaths where the actual magic happens
protected function loadPaths(array $paths, $locale, $group)
{
return (new Collection($paths))
->reduce(function ($output, $path) use ($locale, $group) {
if ($this->files->exists($full = "{$path}/{$locale}/{$group}.php")) { # 1
$output = array_replace_recursive($output, $this->files->getRequire($full)); # 2
}
return $output;
}, []);
}
.php.getRequire(), which executes the PHP file and returns its array.Since we control the namespace URL parameter, we can influence which file the application attempts to load. By supplying a value that maps to a .php script, we can get the server to execute that script. For example, to load phpinfo.php, we can set the parameter to: namespace=phpinfo
The PoC attempts to perform arbitrary file write through the pearcmd.php. This method have been utilized in many similar PoCs and security research
Note that pearcmd.php can be located in different directories such as
/usr/share/php/pearcmd.php/usr/share/php/PEAR/pearcmd.php/usr/lib/php/pearcmd.phpand many more.
The file being written will contain the typical malicious PHP code.
For authorized testing only. Do not use on systems you do not own or have explicit permission to test.
You are responsible for complying with all applicable laws; the authors assume no liability for misuse.
Python requests library is a little tooo helpful as it encodes characters in the provided URL. Spend a long time trying to resolve this issue and ended up just using curl directly. Appreciate, if anyone can provide some help for this issue.