SSRF Vulnerability in Proxmox Virtual Environment and Proxmox Mail Gateway

CVE-2022-35508

What is CVE-2022-35508?

Proxmox Virtual Environment and Proxmox Mail Gateway are susceptible to server-side request forgery (SSRF) vulnerabilities, which arise when HTTP requests are proxied improperly. An attacker with unprivileged access can exploit this flaw to manipulate requests, potentially leading to unauthorized access to sensitive files on the server. Additionally, in the Proxmox Mail Gateway, if backup features are utilized, there exists a risk for privilege escalation to the root@pam account due to incorrect file permissions on backup files, which contain sensitive authentication keys. This issue is resolved in pve-http-server version 4.1-3.

References