Scans Target Unsupported Proxmox VE Servers Following Advisory
Increased scanning activity has been observed targeting Proxmox VE servers, specifically exploiting an advisory for a vulnerability in an unsupported version.
Proxmox VE servers are currently experiencing a surge in scanning activity, a trend that emerged following a recent advisory concerning a vulnerability in an older, unsupported version of the virtualization platform. The vulnerability specifically affects Proxmox VE version 7, which has been out of official support for approximately two years. Despite its unsupported status, the disclosure of this flaw has apparently attracted the attention of malicious actors and security researchers alike.
The observed scans primarily target port 8006, the default port for Proxmox VE's API. Attackers are employing brute-force techniques to compromise the /api2/json/access/ticket endpoint. These attempts often involve sending POST requests with common credentials like 'root' and various passwords, probing for valid login credentials.
Analysis of server logs reveals that these brute-force attempts are often met with HTTP status codes such as 401 (Unauthorized) for failed login attempts. In some instances, attackers may also receive a 308 Permanent Redirect status code, particularly if they initially attempt to connect without TLS encryption. A 308 redirect allows the client to change the request method upon following the redirect, a nuance that differs from 301 or 302 redirects which typically require the same HTTP method.
Beyond the direct brute-force attempts on the authentication endpoint, the scanning activity also includes probes for other indicators. Some scans are observed targeting /pve2/images/logo-128.png, a common fingerprinting technique to identify Proxmox installations. Additionally, a different API endpoint, /api2/extjs/access/ticket, is also being targeted, which behaves differently by always returning a 200 OK status code but indicating login failure through a specific JSON payload size, typically 77 bytes.
The exploitation of unsupported software versions remains a persistent threat in the cybersecurity landscape. Attackers frequently scan for and exploit vulnerabilities in legacy systems that organizations have failed to patch or upgrade, often due to cost, complexity, or simply oversight. Proxmox VE, being a popular platform for managing virtual environments, presents an attractive target.
While the vulnerability affects an unsupported version, it highlights the ongoing risk posed by unpatched systems. Organizations running older versions of Proxmox VE are strongly advised to upgrade to a supported version to mitigate the risk of compromise. The increased scanning activity serves as a clear indicator that attackers are actively seeking out and attempting to exploit these known weaknesses.
This incident underscores the importance of maintaining an up-to-date inventory of all software and systems, prioritizing patching of critical vulnerabilities, and ensuring that end-of-life or unsupported software is either upgraded or decommissioned to prevent potential security breaches.