Proxmox pve-manager handle_api2_request file inclusion

Summaryinfo

A vulnerability identified as problematic has been detected in Proxmox pve-manager, libpve-storage-perl, libpve-http-server-perl, pmg-api and libpve-common-perl. This affects the function handle_api2_request. The manipulation leads to file inclusion. This vulnerability is uniquely identified as CVE-2024-21545. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Proxmox pve-manager, libpve-storage-perl, libpve-http-server-perl, pmg-api and libpve-common-perl and classified as problematic. This issue affects the function handle_api2_request. The manipulation with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API. When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user. Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read. The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.

The advisory is shared at git.proxmox.com. The identification of this vulnerability is CVE-2024-21545 since 12/22/2023. The exploitation is known to be difficult. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.proxmox.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• Proxmox

Name

• libpve-common-perl
• libpve-http-server-perl
• libpve-storage-perl
• pmg-api
• pve-manager

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion