CVE-2023-54391 Proxmox Server Solutions GmbH CVE debrief

Who should care

System administrators and security teams responsible for Proxmox VE infrastructure, particularly versions 7.0 through 8.0, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes reviewing system configurations, user accounts, and authentication mechanisms to verify exposure. Additionally, operators and platform administrators should prioritize patching or upgrading to libpve-access-control version 8.0.4 or later to prevent potential exploitation. Vulnerability management and security teams should also review and enforce strong authentication mechanisms, including multi-factor authentication, to reduce the risk of exploitation.

Technical summary

The CVE-2023-54391 vulnerability is an authentication bypass issue in Proxmox Virtual Environment (VE) 7.0 through 8.0, specifically in libpve-access-control before version 8.0.4. Unauthenticated attackers can bypass password verification by supplying an arbitrary tfa-challenge value in the API login endpoint, allowing them to authenticate as any existing enabled user without a configured second factor. This vulnerability has significant defensive implications, as it could allow attackers to gain unauthorized access to Proxmox VE systems, potentially leading to further exploitation. To mitigate this vulnerability, defenders should prioritize patching or upgrading to libpve-access-control version 8.0.4 or later. Additionally, implementing compensating controls such as IP restrictions or monitoring can help reduce the risk until patching can be performed.

Defensive priority

Organizations using Proxmox Virtual Environment (VE) 7.0 through 8.0 should prioritize immediate action to mitigate the authentication bypass vulnerability.

Recommended defensive actions

• Inventory and assess Proxmox VE versions 7.0 through 8.0 for vulnerability
• Apply patches or upgrades to libpve-access-control version 8.0.4 or later
• Implement compensating controls, such as IP restrictions or monitoring, until patching can be performed
• Verify and enforce strong authentication mechanisms, including multi-factor authentication
• Review system configurations, user accounts, and authentication mechanisms to verify exposure
• Monitor for potential exploitation attempts and review logs for suspicious activity
• Track and document remediation efforts and exceptions

Evidence notes

The CVE-2023-54391 record indicates a critical authentication bypass vulnerability in Proxmox Virtual Environment (VE) 7.0 through 8.0, with a CVSS score of 9.3. The vulnerability exists in libpve-access-control before version 8.0.4, allowing unauthenticated attackers to authenticate as any existing enabled user without a configured second factor.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.