Missing validation of network configuration fields
Affected packages
libpve-common-perl, pve-manager
Details
Some fields/options in the network configuration /etc/network/interfaces which are exposed over the network configuration API were lacking validation, allowing the injection of arbitrary lines in the generated configuration file.
Since some network configuration options allow executing arbitrary commands as root during boot or network settings reload tasks, this effectively is a root privilege escalation which can be triggered by users/tokens with Sys.Modify privileges on /nodes/{node}.
This issue was found internally.
Fixed in
- pve-manager >= 9.2.23
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.