Proxmox VE 7.0–8.0.3 Unauthenticated Single-Request Root Aut...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.nathangolez.com/2026/08/proxmox-ve-7-08-0-3-unauthenticated-single-request-root-auth-bypass
• Blog Title: Proxmox VE 7.0–8.0.3: Unauthenticated Single-Request Root Authentication Bypass
• Suggested Section: Network Services Pentesting / 80,443 - Pentesting Web Methodology / Proxmox VE, with cross-references from 2FA/MFA/OTP Bypass and Login Bypass

🎯 Content Summary

Overview

CVE-2023-54391, documented by Proxmox as PSA-2026-00043-1, is a critical unauthenticated authentication bypass in the Proxmox VE ticket-creation API. It affects libpve-access-control >= 7.0-7 and < 8.0.4, roughly corresponding to Proxmox VE 7.0 through 7.4 and the initial PVE 8.0 releases through package version 8.0.3. Default ...

🔧 Technical Details

Abusing client-selected authentication state: If an authentication endpoint changes from first-factor to second-factor processing based only on the presence of a client-controlled parameter, test whether an unauthenticated requester can enter the later state directly. Here, any truthy tfa-challenge makes the ticket endpoint skip its initial ticket check and causes authenticate_user to return from the second-factor branch before the realm plugin's password validator. A reusable test is to send arbitrary password, OTP, and challenge values while comparing control flow and responses with a normal first-factor login.

Exploiting inconsistent handling of absent MFA configuration: Trace how missing, empty, disabled, migrated, or partially synchronized MFA configuration is represented across authentication layers. In this case, the absence of a legacy keys field caused user_get_tfa to return un...

🤖 Agent Actions

Plan:

1. Map relevant web, authentication-bypass, MFA, and Proxmox content; read at least five candidate pages.
2. Verify the primary advisory and compare the technique against existing coverage.
3. Edit only the best-fitting existing page (or create one only if necessary), with numbered citations and references.
4. Review the diff, validate links/format, and ensure no unrelated changes.
   Repository search found no existing Proxmox page or mention. I’m now comparing the general login/MFA pages with neighboring product-specific web-service guides to choose the correct placement and match their structure.
   The content is not duplicated elsewhere and is substantial enough for a focused product page. I’ll place the full technique under the existing product-specific web-service guides, then add navigation-only links from the web methodology, login-bypass, and MFA pages.
   The page and navigation links are written. I’m reviewing the exact diff now, including citation coverage, page-template requirements, relative paths, and accidental placeholder/forbidden-source leakage.
   The review caught and fixed a SUMMARY.md nesting issue that would have incorrectly made PHP child pages appear under Proxmox. The final step is an mdBook build plus a concise final diff/stat check.
   Implemented the HackTricks update.

Changes

• Added src/network-services-pentesting/pentesting-web/proxmox-ve.md covering:
  • TCP 8006 enumeration
  • Authentication-state confusion PoC
  • Root-cause chain
  • Ticket and CSRF-token usage
  • Package-version verification
  • Detection and remediation
• Added navigation to SUMMARY.md and the web methodology.
• Added cross-references from Login Bypass and 2FA/MFA Bypass.
• Cited the official Proxmox advisory before the supplied research blog.

Validation

• git diff --check passed.
• Markdown structure, citations, code fences, templates, and internal links validated.
• mdbook build could not run because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.nathangolez.com/2026/08/proxmox-ve-7-08-0-3-unauthenticated-single-request-root-auth-bypass

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting / 80,443 - Pentesting Web Methodology / Proxmox VE, with cross-references from 2FA/MFA/OTP Bypass and Login Bypass".

Repository Maintenance:

• MD Files Formatting: 999 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0