External risk intelligence

Proxmox VE Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2023-54391

The vulnerability affects the Proxmox VE API login endpoint. Proxmox VE is a virtualization management platform typically deployed with an internet-accessible web interface and API for remote administration, making the login endpoint a public-facing management surface by design.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Proxmox Virtual Environment versions prior to 8.0.4, specifically impacting the authentication process for API logins. It allows unauthenticated attackers to bypass password requirements and impersonate any enabled user by manipulating a specific API parameter. Given that the affected releases are end-of-life, this presents a significant risk to any unpatched systems.

Attackers bypass login with fake challenge.
Critical for virtualization security and unauthorized access.
Confirm if your Proxmox systems are exposed.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on Proxmox VE by sending a specially crafted POST request to the API login endpoint. This request manipulates the `tfa-challenge` parameter to circumvent password verification, allowing unauthorized access to any enabled user account, including administrative ones.

No authentication required to start.
Supply arbitrary value to `tfa-challenge` parameter.
Unauthorized access to any user account.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication and access the Proxmox VE API as any enabled user, including administrative accounts, by providing a specific value in the `tfa-challenge` parameter. This could lead to unauthorized access to the virtualization environment and its hosted systems.

Unauthorized API access to Proxmox VE.
Via crafted API requests to the login endpoint.
Complete system compromise and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Proxmox Virtual Environment is typically managed by a platform or infrastructure team, with oversight from security and vendor management teams. Given the vulnerability's impact on the API login, the first practical step is to inventory all Proxmox VE instances, verify their exposure to the network, and identify the accountable owners for each. This allows for risk-based prioritization of remediation or mitigation efforts, especially since affected releases are end-of-life.

Proxmox platform or infrastructure teams own this.
Verify all Proxmox VE instances and exposure.
Plan remediation or mitigation for all instances.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Proxmox Virtual Environment?

Proxmox Virtual Environment (VE) is an open-source platform used for enterprise-grade virtualization. It integrates KVM hypervisors and Linux containers, providing a centralized interface to manage virtual machines, storage, and network configurations in a server environment.

What is the vulnerability in CVE-2023-54391?

This is an authentication bypass vulnerability, classified as CWE-304: Missing Critical Step in Authentication. It occurs when the system fails to properly verify user credentials, allowing a bypass of security checks that would normally require a valid password.

How can an attacker trigger this vulnerability?

An attacker can trigger the flaw by sending a specially crafted POST request to the API login endpoint. The vulnerability is activated by providing an arbitrary value in the 'tfa-challenge' parameter, which tricks the system into skipping password verification. It does not trigger if the API login endpoint is unreachable or properly restricted.

Why is this vulnerability relevant to my network?

Halo Surface Signal indicates that Proxmox VE is often deployed with its web interface and API exposed to the internet for remote management. Because this flaw allows remote, unauthenticated access to any user account, including root, any instance reachable over the network is at high risk.

What should I do if I run Proxmox VE?

First, inventory all instances to determine which are running affected versions. Since these versions are end-of-life, the primary step is to prioritize upgrading to a supported release. Restrict network access to the management interface as a temporary measure to reduce exposure while planning your transition.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.