password change via incomplete username validation

Details

An attacker with sufficient privileges to create new PAM user entries (Realm.AllocateUser on /access/realm/pam) could change the PAM password of arbitrary existing users, while disabling them in Proxmox VE's user.cfg at the same time.

An attacker with sufficient privileges to create new user entries in a realm (Realm.AllocateUser on /access/realm/{realm}) could change the password of arbitrary existing users, while disabling them in Proxmox VE's user.cfg at the same time, provided the realm allows setting of passwords via the corresponding authentication plugin.

Both variants circumvent restrictions on password changes which normally apply:

• password changes in the PAM realm are only available to root@pam

• password changes in general require User.Modify on the modified user's groups, if the modified user is a member of any groups

This issue was discovered internally.

Fixed in

• libpve-access-control >= 9.1.2