PSA: Update your Proxmox VE installations (Authentication bypass in EOL Proxmox VE releases​)

Comments

• neeythann Member

  8:19AM

  I was one of the original reporters in the advisory.

  Sharing my repo with the fixes, root cause analysis, and detection rules: https://github.com/neeythann/Proxmox-VE-7-RCE

  Thanked by 7reimuoao oloke rpqu forest Hitori0221 mrerenk stefeman
• rpqu Member

  8:39AM

  @trumvps is this what you mentioned?
• mhpteam Member

  9:10AM edited 9:12AM

  oh, it doesn't affect much anyway
  edit: okay chatgpt scheduled task just sent me an update, which the api /access/ticket can be bypassed completely
• stefeman Member

  9:38AM

  sed -i.bck 's/^\t# This is the 2nd factor, use the password for the OTP response.$/\tverify_ticket($tfa_challenge, 0, $username);\n\t# This is the 2nd factor, use the password for the OTP response./' /usr/share/perl5/PVE/AccessControl.pm

  grep -n 'verify_ticket($tfa_challenge, 0, $username)' /usr/share/perl5/PVE/AccessControl.pm | wc -l

  systemctl restart pvedaemon pveproxy

  Will these make it secure if im unable to patch mine?
• Obelous Member

  9:52AM

  I just don't open Proxmox to the internet.

  
• Alyx Member, Host Rep

  9:54AM

  Well, glad nobody is using EOL software

  Thanked by 2forest oloke
• Neoon Community Contributor, Veteran

  10:01AM

  I didn't upgrade my private proxmox nodes yet....
  Luckly, Proxmox is firewalled anyway.

  Its time to upgrade today I guess.
• JerryHou Veteran

  10:06AM

  I just put my Web UI behind cloudflared tunnel and have a one time pin to it...
• FAT32 Administrator, Deal Compiler Extraordinaire

  10:09AM

  Please dont scan my IPs I think one of mine is running EOL version

  Thanked by 3Murv forest tux
• Neoon Community Contributor, Veteran

  10:11AM

  @Neoon said:
  I didn't upgrade my private proxmox nodes yet....
  Luckly, Proxmox is firewalled anyway.

  Its time to upgrade today I guess.

  Nevermind, the server just hang up while upgrading it.
  Fuck me, but its Safe now, until someone at OVH reboots the server.
• kenjing789 Member

  11:08AM

  The issue is why do you expose Promox dashboard to public internet
• LEBUserJoe Member

  11:11AM

  @kenjing789 said:
  The issue is why do you expose Promox dashboard to public internet

  The amount of services exposed that should not be down to human error, AI usage, or simple arrogance amazes me.

  At anytime there are literally millions of exploitable devices active on the internet right now.

  Thanked by 1forest
• onidel Member, Patron Provider, Top Host, Megathread Squad

  11:27AM

  @FAT32 said:
  Please dont scan my IPs I think one of mine is running EOL version

  you have too many, I’ll pass

  Thanked by 4oloke FAT32 mrerenk tux