CVE-2023-43320: Proxmox Backup Server Privilege Escalation

CVE-2023-43320 Overview

CVE-2023-43320 is an authentication bypass vulnerability affecting multiple Proxmox products that allows remote authenticated attackers to escalate privileges by bypassing the two-factor authentication (2FA) component. The vulnerability exists in the TOTP (Time-based One-Time Password) implementation, which lacks proper rate limiting and account lockout mechanisms, enabling brute-force attacks against the 2FA system.

Critical Impact

Remote authenticated attackers can bypass two-factor authentication protections and escalate privileges across Proxmox virtualization infrastructure, potentially gaining full administrative control over virtual environments, backup systems, and mail gateways.

Affected Products

• Proxmox Virtual Environment (VE) v.5.4 through v.8.0
• Proxmox Backup Server v.1.1 through v.3.0
• Proxmox Mail Gateway v.7.1 through v.8.0

Discovery Timeline

• 2023-09-27 - CVE-2023-43320 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-43320

Vulnerability Analysis

This authentication bypass vulnerability targets the two-factor authentication mechanism in Proxmox products. The core issue stems from the TOTP verification system lacking adequate rate limiting controls and account lockout functionality. An attacker with valid primary credentials (username and password) can systematically brute-force the 6-digit TOTP code without triggering any protective countermeasures.

The vulnerability is particularly dangerous in enterprise virtualization environments where Proxmox VE manages critical infrastructure. Successful exploitation grants the attacker the same privileges as the compromised user account, which could include full administrative access to virtual machines, containers, storage, and network configurations.

Root Cause

The root cause of this vulnerability is the absence of rate limiting and account lockout mechanisms in the TOTP verification code path. Without these security controls, the authentication system accepts unlimited TOTP verification attempts, making it computationally feasible to brute-force the 6-digit code space (1,000,000 possible combinations) within the 30-second TOTP validity window.

Attack Vector

The attack requires network access to the Proxmox management interface and valid primary authentication credentials. An attacker can leverage automated tools to rapidly iterate through TOTP codes until a valid one is found. The Packet Storm Security Exploit documents a proof-of-concept for this TOTP brute-force technique against Proxmox VE 7.4-1.

The following patch from the official Proxmox repository demonstrates the security fix that implements rate limiting and account lockout:

    /// available for PVE, where the yubico API server configuration is part if the realm.
    #[serde(skip_serializing_if = "Vec::is_empty", default)]
    pub yubico: Vec<TfaEntry<String>>,

    /// Once a user runs into a TOTP limit they get locked out of TOTP until they successfully use
    /// a recovery key.
    #[serde(skip_serializing_if = "bool_is_false", default)]
    pub totp_locked: bool,

    /// If a user hits too many 2nd factor failures, they get completely blocked for a while.
    #[serde(skip_serializing_if = "Option::is_none", default)]
    pub tfa_blocked_until: Option<i64>,
}

impl TfaUserData {

Source: GitHub Proxmox Commit

Detection Methods for CVE-2023-43320

Indicators of Compromise

• Unusually high volume of failed 2FA/TOTP authentication attempts for a single user account
• Rapid succession of authentication requests from the same source IP targeting the same account
• Successful authentication following multiple failed TOTP attempts within a short timeframe
• Authentication logs showing TOTP verification attempts exceeding normal user behavior patterns

Detection Strategies

• Implement monitoring rules to alert on more than 5-10 failed TOTP attempts per user within a 60-second window
• Deploy network-based detection for high-frequency POST requests to Proxmox authentication endpoints
• Utilize SentinelOne Singularity to monitor for anomalous authentication patterns and privilege escalation attempts
• Correlate authentication logs with user behavior baselines to identify brute-force attack patterns

Monitoring Recommendations

• Enable verbose authentication logging on all Proxmox management interfaces
• Configure SIEM alerts for authentication anomalies against Proxmox infrastructure
• Monitor for unauthorized administrative actions following successful authentication events
• Review access logs for the /api2/json/access/ticket endpoint for suspicious activity patterns

How to Mitigate CVE-2023-43320

Immediate Actions Required

• Update all affected Proxmox products to patched versions immediately
• Review authentication logs for signs of exploitation attempts
• Audit user accounts with administrative privileges for unauthorized access
• Consider temporarily disabling TOTP-only 2FA and switching to hardware security keys (U2F/FIDO2) until patches are applied

Patch Information

Proxmox has released security patches that implement TOTP rate limiting and account lockout mechanisms. The fix introduces a totp_locked flag that locks users out of TOTP authentication after exceeding the failure threshold, requiring recovery key usage to regain access. Additionally, a tfa_blocked_until timestamp provides temporary account blocking after excessive 2FA failures.

Refer to Proxmox Bugzilla Report #4579 and Proxmox Bugzilla Report #4584 for official patch details. The security fix is available in the GitHub Proxmox Commit.

Workarounds

• Implement network-level rate limiting using a web application firewall (WAF) or reverse proxy in front of Proxmox management interfaces
• Restrict management interface access to trusted IP addresses using firewall rules
• Deploy hardware-based 2FA tokens (YubiKey, FIDO2) instead of TOTP where supported
• Enable additional authentication logging and alerting to detect brute-force attempts before successful exploitation

# Example: Restrict Proxmox web interface access to management network
iptables -A INPUT -p tcp --dport 8006 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8006 -j DROP