Proxmox VE: unauthenticated API login bypass via arbitrary tfa-challenge yields root@pam

CVE-2023-54391Kernel, userspace & hypervisorcurated

Impact

An unauthenticated POST to the access ticket API endpoint carrying any value in the tfa-challenge parameter skips password verification entirely and returns a ticket for any enabled user that has no second factor configured, root@pam included. On a Proxmox host used for GPU passthrough that is full hypervisor control: VM start/stop, console access to every guest on the node, guest disk images, PCI passthrough assignment and the host shell. One reachable management interface therefore compromises every tenant VM on that host, and the node cannot be cleaned up without taking those guests down. The advisory notes all affected releases (VE 7.0 through 8.0) are end of life, so clusters still exposed are also missing everything else fixed since.

Who can reach it

Anyone who can reach the Proxmox VE web/API listener - normally the management VLAN, and internet-facing if the interface was ever published. No authentication and no valid username-password pair required; the account only needs to exist, be enabled, and have no configured second factor.

What to do

Upgrade libpve-access-control to 8.0.4 or later. Because every affected release line is end of life, the real remediation is moving the cluster onto a currently supported Proxmox VE release rather than patching one package. The fix ships as a package upgrade with a restart of pveproxy/pvedaemon - no guest downtime and no host reboot. Until that lands, restrict the API listener to the management network and add a second factor to root@pam and every other privileged account, since accounts with 2FA configured are not bypassed.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-54391 https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022 https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929 https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.