Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2024-21545: Proxmox Downloading Sensitive Files with Elevated Privileges
CVE-2024-21545 · published 2 years ago
Summary
An attacker with certain admin privileges can download sensitive files from a Proxmox server, potentially leading to system compromise. This can happen if an attacker exploits a weakness in how Proxmox handles API responses. To fix this, update to the latest version of Proxmox, or patch the vulnerable version if possible.
Original advisory text
Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers w...
Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API.
When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user.
Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read.
The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.
When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user.
Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read.
The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-73External Control of File Name or Path
Timeline
Published25 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-21545 · NVD
Track software like this
Free during beta