Insufficient Safeguards Against Malicious API Response Values Allows Arbitrary File Read

CVE-2024-21545

What is CVE-2024-21545?

The Proxmox Virtual Environment, an open-source platform designed for enterprise virtualization, is prone to an arbitrary file read vulnerability due to insufficient safeguards against malicious API response values. This vulnerability permits authenticated users with 'Sys.Audit' or 'VM.Monitor' privileges to exploit the API, allowing them to download local files from the host. Specifically, the flaw arises within the handle_api2_request function, which inadequately validates request handler responses before returning them. By manipulating request objects, attackers have the potential to control the response object sufficiently, leading to unauthorized access to sensitive files. This vulnerability can result in serious security implications, including unauthorized disclosure of sensitive information and the possibility of session forgery, raising significant concerns about the overall integrity of the system.

References