CVE-2023-54391: Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Proxmox VEto a version that resolves this vulnerability.Fixed in 8.0.4 - Compensating control
Block access to the Proxmox VE API login/access ticket endpoint from untrusted networks (e.g., restrict management/API traffic via firewall/ACL/WAF) until the fixed version is applied.
Event History
Frequently Asked Questions
Which accounts can an attacker impersonate?
An unauthenticated attacker can authenticate as any existing enabled user that does not have a configured second factor. This includes root@pam if that account is enabled and has no second factor configured.
What does an attacker need to exploit this issue?
The attacker only needs network access to the API login endpoint and can submit a POST request containing an arbitrary tfa-challenge parameter. No valid credentials or user interaction are required.
Are installations with second-factor authentication protected?
The bypass applies to existing enabled users without a configured second factor. Accounts with a configured second factor are not identified as affected by the provided information.
Which versions contain the vulnerable component?
The issue affects Proxmox VE 7.0 through 8.0 where libpve-access-control is earlier than 8.0.4. The supplied data states that all affected releases are end of life.