Missing shell quoting for ceph install command options
Affected packages
pve-manager
Details
Missing shell quoting for parameters passed to termproxy while handling xtermjs API requests allowed an attacker to execute arbitrary commands as root, if they managed to trick a user logged in as root@pam into opening a crafted URL containing such parameters.
This issue was found internally.
Fixed in
- pve-manager >= 9.2.24
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.