External risk intelligence

Proxmox Virtual Environment Reflected Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2022-31358

Proxmox Virtual Environment is typically deployed as a management interface for virtualization infrastructure. While these interfaces are often restricted to internal networks or VPN access by administrators, they are web-based and can be exposed to the internet in some deployment scenarios, making them plausibly reachable, though they are not designed to be public-facing services.

Cross-site Scripting

Proxmox Virtual Environment

before 7.2-3

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Proxmox Virtual Environment could allow unauthorized users to execute malicious code through web scripts. This issue affects the system's web interface and could potentially compromise its functionality. The main concern is confirming whether our specific deployment is exposed and, if so, understanding the potential impact.

Malicious web scripts can run on the system.
Ensures visibility into critical infrastructure management.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user with low privileges into visiting a malicious link. This link would point to a non-existent endpoint within the Proxmox Virtual Environment's API, triggering the cross-site scripting vulnerability. Successful exploitation could allow an attacker to execute arbitrary web scripts or HTML within the context of the victim's session.

Requires authenticated, low-privileged user access.
Triggered by navigating to a crafted non-existent API endpoint.
Allows arbitrary script execution in user's browser.

Live Threat

Current exploitation, exposure, and threat context

A reflected cross-site scripting vulnerability in Proxmox Virtual Environment could allow an authenticated attacker to execute arbitrary web scripts or HTML. This could occur when a user visits a crafted link to non-existent endpoints under the `/api2/html/` path, potentially leading to the compromise of user sessions or the injection of malicious content.

Proxmox Virtual Environment management interface.
Via crafted links to non-existent endpoints.
May lead to session hijacking or content injection.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Proxmox Virtual Environment platform team is likely responsible for addressing this vulnerability, as it impacts the core management interface. The first practical step is to identify all instances of Proxmox Virtual Environment, determine their network exposure, confirm business criticality, and then engage with the platform owner or vendor management for coordinated remediation.

Platform team owns the issue.
Verify exposure and criticality of instances.
Plan upgrade or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Proxmox Virtual Environment?

Proxmox Virtual Environment is an open-source platform used for enterprise virtualization. It combines a KVM hypervisor and Linux containers with a centralized web-based management interface, allowing administrators to manage virtual machines, storage, and network resources from a single location.

What is the nature of the vulnerability in CVE-2022-31358?

This CVE involves a Reflected Cross-Site Scripting (XSS) weakness, categorized as CWE-79. It occurs when an application includes untrusted data in a web page without proper validation. In this case, the management interface fails to safely handle input sent to specific API paths, potentially allowing malicious scripts to execute within a user's browser session.

How is this XSS vulnerability triggered?

The flaw is triggered when an attacker convinces an authenticated user to click a specially crafted link pointing to a non-existent endpoint under the '/api2/html/' path. Simply accessing valid or standard management pages does not trigger this issue; it specifically requires interaction with these malformed API request paths.

Is my Proxmox instance at risk?

According to Halo Surface Signal, Proxmox VE is primarily designed as an internal management interface and is not intended to be a public-facing service. However, if your instance is reachable via the internet—even if restricted to specific networks—the risk of exposure increases. Reviewing your network perimeter to ensure management interfaces remain isolated is recommended.

How do I address this CVE?

Begin by auditing your environment to locate all running instances of Proxmox VE. For any system running a version earlier than 7.2-3, plan an update to a patched release. Coordinate with your platform or infrastructure team to verify the current version and schedule the necessary maintenance to close this security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.