XSS in various UI components

Details

Various dialogues in the web interface were susceptible to XSS:

• The VM Hardware panel, because of the romfile for PCI devices. This requires an attacker to have the Mapping.Use privilege for a PCI mapping.

• The VM Cloud-Init panel, because of the searchdomain field. This requires an attacker to have the VM.Config.Cloudinit or VM.Config.Network privilege for a VM.

• The node's Certificates panel, because of the Subject Alternative Names field. This requires an attacker to have the Sys.Modify privilege for a node.

The issues for the VM panels were privately reported by Geoffrey McClinsey <[email protected]>.

The issues with the certificates component, were privately reported by Nguyen Van Thuy <[email protected]> and Luong Huynh Minh Kien <[email protected]>.

Fixed in

• pve-manager >= 9.2.11 (PVE 9.x)

• proxmox-widget-toolkit >= 5.2.8 (PVE 9.x)

• pve-manager >= 8.4.21 (PVE 8.x)

• proxmox-widget-toolkit >= 4.3.18 (PVE 8.x)