CRITICAL
Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon
Published Dec 4, 2022
9.8
CRITICALCVSS 3.1
EPSS 1.24%
Description
Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.
Affected products
No data.
OR
- n/a
- < 4.1-3
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38396 Advisory
- https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=580d540ea907ba15f64379c5bb69ecf1a49a875f
- https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=c2bd69c7b5e9c775f96021cf8ae53da3dbd9029d
- https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=e9df8a6e76b2a18f89295a5d92a62177bbf0f762
- https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/ ExploitPatchTechnical DescriptionThird Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 4, 2022
Updated Apr 24, 2025
Reserved Jul 11, 2022
Link CVE-2022-35508
CISA Vulnrichment
Updated Apr 24, 2025
ENISA EUVD
EUVD-2022-38396 Assigner mitre
Published Dec 4, 2022
Updated Apr 24, 2025
Exploited since n/a
Link EUVD-2022-38396