Add auxiliary module for Pterodactyl Panel CVE-2025-49132

[n05ec]

Description

This PR adds an auxiliary scanner module for CVE-2025-49132, a path traversal vulnerability in Pterodactyl Panel. The vulnerability allows unauthenticated attackers to read the configuration file (including APP_KEY) via the /locales/locale.json endpoint.

Verification

• Start msfconsole
• use auxiliary/scanner/http/pterodactyl_traversal_cve_2025_49132
• set RHOSTS <vulnerable_ip>
• run
• Verify that the module detects the vulnerability and reports it.

[github-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[bcoles]

Rather than force the user to manually perform both the traversal and the URL encoding themselves, the typical approach is to expose a FILENAME option (or similar) and a DEPTH option to specify the traversal depth. You can find many example modules with grep DEPTH modules/auxiliary/.

[n05ec]

@bcoles I have updated the module based on your feedback:

1. Refactored the code to use DEPTH and FILE options instead of hardcoded URIs.
2. Added the missing documentation file following the official template.
3. Verified the module works locally with the new logic.

Please review it again. Thanks!

[jheysel-r7]

If you setup Pterodactyl Panel using docker would you be able to paste the docker-compose.yml / Dockerfile here?

[n05ec]

Sure, I have applied the suggested change.

Here is the docker-compose.yml I used to set up the vulnerable environment (Pterodactyl Panel v1.11.10).

version: '3.8'
services:
  database:
    image: public.ecr.aws/docker/library/mariadb:10.5
    restart: always
    environment:
      MYSQL_DATABASE: panel
      MYSQL_USER: pterodactyl
      MYSQL_PASSWORD: password
      MYSQL_ROOT_PASSWORD: root_password
    volumes:
      - db_data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  cache:
    image: public.ecr.aws/docker/library/redis:alpine
    restart: always

  panel:
    image: ghcr.io/pterodactyl/panel:v1.11.10
    ports:
      - "80:80"
    environment:
      DB_HOST: database
      DB_DATABASE: panel
      DB_USERNAME: pterodactyl
      DB_PASSWORD: password
      REDIS_HOST: cache
      APP_URL: "http://localhost"
      APP_ENV: "local"
      APP_DEBUG: "true"
      APP_SERVICE_AUTHOR: "[email protected]"
      APP_TIMEZONE: "Asia/Shanghai"
    depends_on:
      database:
        condition: service_healthy
      cache:
        condition: service_started
    volumes:
      - panel_data:/app/var/

volumes:
  db_data:
  panel_data: