Scans for Proxmox Servers, (Wed, Sep 9th)
A vulnerability in older versions of Proxmox VE (version 7) has attracted attacker attention, with increased scans targeting port 8006 and attempts to exploit the access ticket endpoint. Researchers are observing brute-force attacks and attempts to bypass authentication, indicating a potential for exploitation.
Proxmox VE, a virtualization platform, has a known vulnerability in version 7, which is no longer supported. Recent analysis by Johannes B. Ullrich at SANS indicates that attackers are actively scanning for this vulnerability. Specifically, there’s a significant increase in scans targeting port 8006. The vulnerability involves an access ticket endpoint, where attackers are attempting to brute-force login credentials. The proxy logs show numerous failed login attempts, often accompanied by a 401 status code. Researchers have also identified a POST request to /api2/extjs/access/ticket that always returns a 200 status code, but contains login failure messages – a more subtle attempt to bypass authentication. The 308 status code is also being used when TLS is not initially used, and a POST request is sent. These attempts highlight a real risk of exploitation and underscore the importance of updating to a supported version of Proxmox VE.