User impersonation via inconsistent ticket encoding
Affected packages
libpve-common-perl
Details
Incosistent handling of encoding/decoding usernames in authentication tickets allows an attacker to impersonate other users in the same realm. This attack requires sufficient privileges to create users in a realm, or access to an OIDC/LDAP/AD source of user identifiers that does not restricted usernames to forbid certain characters.
This issue was discovered internally, and later also reported by Apo - CSB Raccoon <[email protected]>.
Fixed in
- libpve-common-perl >= 9.2.5
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.