CVE-2025-49132 Proof of Concept (PoC)

This repository contains a Proof of Concept (PoC) for CVE-2025-49132, a critical unauthenticated remote code execution (RCE) vulnerability in Pterodactyl Panel versions prior to 1.11.11.

Vulnerability Details

• CVE ID: CVE-2025-49132
• Severity: 10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Affected Versions: < 1.11.11 (e.g., 1.9.0 to 1.11.10)
• Description: An unauthenticated arbitrary remote code execution vulnerability exists in the Pterodactyl Panel through the /locales/locale.json endpoint, exploitable via the locale and namespace query parameters. This allows attackers to execute arbitrary code, read sensitive files (e.g., configs, .env), dump databases, and access managed servers.
• Advisory: GitHub Security Advisory GHSA-24wv-6c99-f843
• Patch: Fixed in v1.11.11. Apply the patch from commit 24c82b0 or upgrade immediately.
• Workarounds: Use an external WAF (e.g., Cloudflare). No software workaround; disable the endpoint at web server level if feasible (breaks localization).

PoC Script

The script CVE-2025-49132-PoC.py is an automated tool that can:

• Test if a target is vulnerable (checks for path traversal to config files).
• Exploit for limited RCE (sleep 5 seconds as demonstration; requires PEAR installed).
• Dump database credentials (from config/database).

It supports both Linux and Windows targets by adjusting path separators. Includes colored output and error handling for better usability.

Usage

python CVE-2025-49132-PoC.py <mode> <http://host> [--os <linux|windows>] [--traversal-level <int>]

#Example of commands

python CVE-2025-49132-PoC.py test http://sub.domain.com
python CVE-2025-49132-PoC.py dump http://domain.com
python CVE-2025-49132-PoC.py exploit http://sub.domain.com --os linux
python CVE-2025-49132-PoC.py test http://sub.domain.com --os linux --traversal-level 3

If the check fails, review the printed URL, status, and response. The response may be HTML if the endpoint is blocked or not vulnerable. Ensure the host is correct and reachable.

Modes:

• test: Check vulnerability.
• exploit: Perform RCE (sleep 5 seconds as PoC).
• dump: Dump credentials.
• --os: linux (default) or windows
• --traversal-level: Number of '../' (default 3 for config/dump, 5 for RCE). Adjust if paths differ (e.g., 4 or 6).

OpSec Considerations

• RCE exploitation can be detected via logs: cat /var/www/pterodactyl/storage/logs/laravel-2025--.log | grep 'Illuminate\Translation\FileLoader->load()'
• If access logs are enabled, look for locale=.. entries.
• Default config (without SSL) may not log credentials easily.

Legal Disclaimer

This PoC is provided for educational purposes only or for use in authorized challenges such as CTFs (Capture The Flag) or penetration testing with explicit permission. It is illegal to use this against any system without prior written consent from the owner. The author assumes no liability for any misuse of this code.

Installation

Requires Python 3 and requests (install via pip install requests).

Dependencies

• requests (pip install requests)
• colorama (pip install colorama)
• urllib3 (pip install urllib3)
• argparse (standard library)

License

MIT License. See LICENSE file.

Contributing

Pull requests are welcome for improvements, but ensure they align with educational intent.