Scans target unsupported Proxmox VE 7 systems
Following a Proxmox advisory on a flaw in EOL Proxmox VE 7, SANS ISC observed increased port 8006 scanning and brute-force login attempts against the API.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Proxmox disclosed a vulnerability affecting only version 7 of its Virtual Environment product, which reached end-of-support roughly two years ago. SANS Internet Storm Center reports a noticeable uptick in scanning against TCP/8006 (the default Proxmox web/API port) along with brute-force authentication attempts targeting the /api2/json/access/ticket endpoint, using credentials such as root@pam. Failed logins on this endpoint return HTTP 401, while a 308 status can appear when an attacker's initial request is sent over plain HTTP and gets redirected to HTTPS while preserving the POST method.
Analysts also observed fingerprinting requests for the static /pve2/images/logo-128.png resource (likely used to identify Proxmox installations) and probes against an alternate authentication endpoint, /api2/extjs/access/ticket, which always returns HTTP 200 regardless of outcome — success/failure must be inferred from the JSON response body size (roughly 77 bytes indicating a failed login). This makes proxy-log-only detection unreliable for that endpoint and defenders should inspect response payloads or application-level logging instead.
No evidence is presented that the underlying Proxmox VE 7 vulnerability is being actively exploited beyond reconnaissance and credential brute-forcing; the activity appears opportunistic scanning likely triggered by the public advisory. Defenders running any version of Proxmox VE should confirm they are on a supported, patched release, restrict management interface (port 8006) exposure to trusted networks, enforce strong/unique credentials and lockout policies for the root@pam account, and monitor for repeated 401/308 responses on /api2/json/access/ticket and anomalous small-payload responses on /api2/extjs/access/ticket.
Source reporting: https://isc.sans.edu/diary/rss/33324
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs