PSA: Update your Proxmox VE installations (Authentication bypass in EOL Proxmox VE releases​)

Comments

• neeythann Member

  8:19AM

  I was one of the original reporters in the advisory.

  Sharing my repo with the fixes, root cause analysis, and detection rules: https://github.com/neeythann/Proxmox-VE-7-RCE

  Thanked by 10reimuoao oloke rpqu forest Hitori0221 mrerenk stefeman tzuli zGato Porlam
• rpqu Member

  8:39AM

  @trumvps is this what you mentioned?
• mhpteam Member

  9:10AM edited 9:12AM

  oh, it doesn't affect much anyway
  edit: okay chatgpt scheduled task just sent me an update, which the api /access/ticket can be bypassed completely
• stefeman Member

  9:38AM

  sed -i.bck 's/^\t# This is the 2nd factor, use the password for the OTP response.$/\tverify_ticket($tfa_challenge, 0, $username);\n\t# This is the 2nd factor, use the password for the OTP response./' /usr/share/perl5/PVE/AccessControl.pm

  grep -n 'verify_ticket($tfa_challenge, 0, $username)' /usr/share/perl5/PVE/AccessControl.pm | wc -l

  systemctl restart pvedaemon pveproxy

  Will these make it secure if im unable to patch mine?
• Obelous Member

  9:52AM

  I just don't open Proxmox to the internet.

  
• Alyx Member, Host Rep

  9:54AM

  Well, glad nobody is using EOL software

  Thanked by 5forest oloke zGato Porlam Decicus
• Neoon Community Contributor, Veteran

  10:01AM

  I didn't upgrade my private proxmox nodes yet....
  Luckly, Proxmox is firewalled anyway.

  Its time to upgrade today I guess.
• JerryHou Veteran

  10:06AM

  I just put my Web UI behind cloudflared tunnel and have a one time pin to it...
• FAT32 Administrator, Deal Compiler Extraordinaire

  10:09AM

  Please dont scan my IPs I think one of mine is running EOL version

  Thanked by 7Murv forest tux Obelous zGato Porlam Decicus
• Neoon Community Contributor, Veteran

  10:11AM

  @Neoon said:
  I didn't upgrade my private proxmox nodes yet....
  Luckly, Proxmox is firewalled anyway.

  Its time to upgrade today I guess.

  Nevermind, the server just hang up while upgrading it.
  Fuck me, but its Safe now, until someone at OVH reboots the server.
• kenjing789 Member

  11:08AM

  The issue is why do you expose Promox dashboard to public internet
• LEBUserJoe Member

  11:11AM

  @kenjing789 said:
  The issue is why do you expose Promox dashboard to public internet

  The amount of services exposed that should not be down to human error, AI usage, or simple arrogance amazes me.

  At anytime there are literally millions of exploitable devices active on the internet right now.

  Thanked by 1forest
• onidel Member, Patron Provider, Top Host, Megathread Squad

  11:27AM

  @FAT32 said:
  Please dont scan my IPs I think one of mine is running EOL version

  you have too many, I’ll pass

  Thanked by 7oloke FAT32 mrerenk tux rpqu zGato Decicus
• reimuoao Member

  1:34PM

  @stefeman said:
  Will these make it secure if im unable to patch mine?

  For sure, yes.

  @kenjing789 said:
  The issue is why do you expose Promox dashboard to public internet

  There are still some incompetent VPS providers/summer hosts exist, running ancient versions of PVE and the ModulesGarden PVE WHMCS Module, that the end user VNC console connects directly to Internet exposed PVE dashboards rather than going through a secure proxy. They won't do security audits/upgrades until things really breaks.