Critical · published December 4, 2022
🚨 An attacker with just an unprivileged account can exploit a sneaky SSRF in Proxmox that leads to sensitive file disclosure and even root access! 🔥 Think of it like having a delivery driver who can peek into your house while dropping off packages — they can rummage through your files without you even knowing. With this vulnerability, a crafty attacker could send a request that reveals sensitive information hidden behind your defenses. This is absolutely devastating! An attacker can gain access to any file on the server, potentially including sensitive data or configuration files. Even worse, if they manage to manipulate the backup feature, they could escalate their access to the root@pam account, giving them control over the entire system.
Think of it like having a delivery driver who can peek into your house while dropping off packages — they can rummage through your files without you even knowing. With this vulnerability, a crafty attacker could send a request that reveals sensitive information hidden behind your defenses. The SSRF vulnerability exists due to improper handling of HTTP requests between the Proxmox proxy and daemon, allowing unprivileged users to view any server file and escalate privileges using backup files with loose permissions.
This is absolutely devastating! An attacker can gain access to any file on the server, potentially including sensitive data or configuration files. Even worse, if they manage to manipulate the backup feature, they could escalate their access to the root@pam account, giving them control over the entire system. Immediately update to pve-http-server version 4.1-3 or later to patch this critical vulnerability. Additionally, review file permissions for backup files to tighten security and ensure unauthorized access is not possible. Implement strict access controls to minimize risks further. You've got this! By taking these steps, you'll turn this potential disaster into a secured environment. 🛡️