password change via incomplete username validation
Betroffene Pakete
pve-access-control
Details
An attacker with sufficient privileges to create new PAM user entries (Realm.AllocateUser on /access/realm/pam) could change the PAM password of arbitrary existing users, while disabling them in Proxmox VE's user.cfg at the same time.
An attacker with sufficient privileges to create new user entries in a realm (Realm.AllocateUser on /access/realm/{realm}) could change the password of arbitrary existing users, while disabling them in Proxmox VE's user.cfg at the same time, provided the realm allows setting of passwords via the corresponding authentication plugin.
Both variants circumvent restrictions on password changes which normally apply:
- password changes in the PAM realm are only available to root@pam
- password changes in general require User.Modify on the modified user's groups, if the modified user is a member of any groups
This issue was discovered internally.
Behoben in
- libpve-access-control >= 9.1.2
Diese Seite ist eine inoffizielle Kopie des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab). Prüfe vor jeder Maßnahme das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.