Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
25% Recurring Discount on NVMe VPS
Try EnsoVPN - Reliable VPN - 1-Day Free Trial
K.N Cloud — High-Performance KVM VPS in Miami,Frankfurt and Amsterdam
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
Try EnsoVPN - Fast & Private VPN - 1-Day Free Trial
K.N Cloud | Linux Cloud Instances in US-MIA, DE-FRA and NL-AMS

Categories

In this Discussion

Home › News › Security
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

PSA: Update your Proxmox VE installations (Authentication bypass in EOL Proxmox VE releases​)

reimuoaoreimuoao Member
in Security

https://forum.proxmox.com/posts/867929/

TL;DR:

  • Older, EOL versions of Proxmox VE have an actively exploited vulnerability with the libpve-access-control package (Affected: >= 7.0-7 and < 8.0.4)
  • If 8006 WebUI/API is exposed to public Internet, attackers can bypass passwords entirely to authenticate as root, due to a cursed 2FA implementation
  • Current supported PVE versions (9.x) are completely safe
  • If you are still running PVE 7.x-8.0.3, restrict access to port 8006 and upgrade immediately
Thanked by 5oloke rpqu Murv forest JerryHou

Comments

  • neeythannneeythann Member

    I was one of the original reporters in the advisory.

    Sharing my repo with the fixes, root cause analysis, and detection rules: https://github.com/neeythann/Proxmox-VE-7-RCE

    Thanked by 7reimuoao oloke rpqu forest Hitori0221 mrerenk stefeman
  • rpqurpqu Member

    @trumvps is this what you mentioned?

  • mhpteammhpteam Member
    edited 9:12AM

    oh, it doesn't affect much anyway :)
    edit: okay chatgpt scheduled task just sent me an update, which the api /access/ticket can be bypassed completely

  • stefemanstefeman Member

    sed -i.bck 's/^\t# This is the 2nd factor, use the password for the OTP response.$/\tverify_ticket($tfa_challenge, 0, $username);\n\t# This is the 2nd factor, use the password for the OTP response./' /usr/share/perl5/PVE/AccessControl.pm

    grep -n 'verify_ticket($tfa_challenge, 0, $username)' /usr/share/perl5/PVE/AccessControl.pm | wc -l

    systemctl restart pvedaemon pveproxy

    Will these make it secure if im unable to patch mine?

  • ObelousObelous Member

    I just don't open Proxmox to the internet.

  • AlyxAlyx Member, Host Rep

    Well, glad nobody is using EOL software

    Thanked by 2forest oloke
  • NeoonNeoon Community Contributor, Veteran

    I didn't upgrade my private proxmox nodes yet....
    Luckly, Proxmox is firewalled anyway.

    Its time to upgrade today I guess.

  • JerryHouJerryHou Veteran

    I just put my Web UI behind cloudflared tunnel and have a one time pin to it...

  • FAT32FAT32 Administrator, Deal Compiler Extraordinaire

    Please dont scan my IPs I think one of mine is running EOL version

    Thanked by 1Murv
  • NeoonNeoon Community Contributor, Veteran

    @Neoon said:
    I didn't upgrade my private proxmox nodes yet....
    Luckly, Proxmox is firewalled anyway.

    Its time to upgrade today I guess.

    Nevermind, the server just hang up while upgrading it.
    Fuck me, but its Safe now, until someone at OVH reboots the server.

Sign In or Register to comment.