Scans target unsupported Proxmox VE 7 systems

Following a Proxmox advisory on a flaw in EOL Proxmox VE 7, SANS ISC observed increased port 8006 scanning and brute-force login attempts against the API.

Proxmox disclosed a vulnerability affecting only version 7 of its Virtual Environment product, which reached end-of-support roughly two years ago. SANS Internet Storm Center reports a noticeable uptick in scanning against TCP/8006 (the default Proxmox web/API port) along with brute-force authentication attempts targeting the /api2/json/access/ticket endpoint, using credentials such as root@pam. Failed logins on this endpoint return HTTP 401, while a 308 status can appear when an attacker's initial request is sent over plain HTTP and gets redirected to HTTPS while preserving the POST method.

Analysts also observed fingerprinting requests for the static /pve2/images/logo-128.png resource (likely used to identify Proxmox installations) and probes against an alternate authentication endpoint, /api2/extjs/access/ticket, which always returns HTTP 200 regardless of outcome — success/failure must be inferred from the JSON response body size (roughly 77 bytes indicating a failed login). This makes proxy-log-only detection unreliable for that endpoint and defenders should inspect response payloads or application-level logging instead.

No evidence is presented that the underlying Proxmox VE 7 vulnerability is being actively exploited beyond reconnaissance and credential brute-forcing; the activity appears opportunistic scanning likely triggered by the public advisory. Defenders running any version of Proxmox VE should confirm they are on a supported, patched release, restrict management interface (port 8006) exposure to trusted networks, enforce strong/unique credentials and lockout policies for the root@pam account, and monitor for repeated 401/308 responses on /api2/json/access/ticket and anomalous small-payload responses on /api2/extjs/access/ticket.

title: Proxmox Authentication Brute Force via JSON API
description: Detects repeated failed authentication attempts against Proxmox VE JSON
  API ticket endpoint, typically targeting root@pam credentials. High volume of 401
  responses within a short window suggests credential brute-forcing rather than legitimate
  admin login attempts.
tags:
- attack.credential-access
- attack.t1110.001
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_method: POST
    uri|contains: /api2/json/access/ticket
    destination_port: 8006
    http_status: 401
  condition: selection
falsepositives:
- Users with incorrect saved credentials in Proxmox web UI or API clients
- Legitimate automation scripts with misconfigured credentials
level: medium
id: b331b7e7-dfa7-5836-9e33-3ffc02b9f4b6
status: experimental
author: Vorant

title: Proxmox Fingerprinting via Static Logo Request
description: Detects reconnaissance attempts against Proxmox VE by requesting the
  static logo image resource. Attackers use this to identify Proxmox installations
  and confirm service availability before launching brute-force or exploitation attempts.
tags:
- attack.reconnaissance
- attack.t1595
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_method: GET
    uri|contains: /pve2/images/logo-128.png
    destination_port: 8006
  condition: selection
falsepositives:
- Legitimate administrators accessing the Proxmox web UI
- Monitoring/vulnerability scanning tools with Proxmox fingerprint rules
level: low
id: c0b803ce-6d04-5faa-9e3d-52d0e162aebf
status: experimental
author: Vorant

title: Proxmox Authentication Attempt via ExtJS API with HTTP to HTTPS Redirect
description: Detects authentication probes against Proxmox VE using insecure HTTP
  connection (returning 308 redirect to HTTPS), or attempts against the ExtJS authentication
  endpoint (/api2/extjs/access/ticket). Redirects suggest attacker is not properly
  following HTTPS, or fingerprinting the service configuration. Multiple requests
  with small response payloads (~77 bytes) indicate credential validation attempts.
tags:
- attack.credential-access
- attack.t1110
logsource:
  category: proxy
  product: generic
detection:
  selection_http_redirect:
    http_method: POST
    uri|contains: /api2/json/access/ticket
    destination_port: 8006
    http_status: 308
  selection_extjs_endpoint:
    http_method: POST
    uri|contains: /api2/extjs/access/ticket
    destination_port: 8006
  condition: 1 of selection_*
falsepositives:
- Proxmox API clients that do not automatically handle HTTPS upgrades
- Legacy monitoring tools using the ExtJS endpoint for status checks
level: medium
id: fdaa7bbb-4bb8-5157-8f35-feac7ae2de1c
status: experimental
author: Vorant

Source reporting: https://isc.sans.edu/diary/rss/33324