CVE-2025-57539: Proxmox Virtual Environment XSS Vulnerability

CVE-2025-57539 Overview

CVE-2025-57539 is a stored cross-site scripting (XSS) vulnerability affecting Proxmox Virtual Environment (PVE) 8.4. The flaw resides in the U2F Origin field of the Datacenter configuration, where authenticated users can inject malicious payloads. The Web UI renders the stored input unsafely, executing attacker-controlled JavaScript in the browser of any user who views the affected page.

Successful exploitation can lead to session hijacking, credential theft, or unauthorized actions performed in the context of a privileged administrator. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated low-privilege user can stage persistent JavaScript that executes in administrator sessions, enabling session hijacking and lateral movement within the virtualization management plane.

Affected Products

Proxmox Virtual Environment 8.4
Datacenter configuration component (U2F Origin field)
Proxmox Web UI

Discovery Timeline

2025-09-09 - CVE-2025-57539 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57539

Vulnerability Analysis

The vulnerability exists in the Datacenter configuration interface of Proxmox VE 8.4, specifically in how the U2F Origin field processes user-supplied input. The application accepts data intended to configure Universal Second Factor (U2F) authentication origins but fails to sanitize or encode the value before persisting it and rendering it in the Web UI.

Because the payload is stored in the datacenter configuration, it persists across sessions and executes whenever an authorized user loads the affected view. The attack requires authentication with permissions to modify datacenter settings, and it requires a victim user to visit the injected view. The scope changes because script execution in a privileged administrator's browser context grants access beyond the attacker's original permissions.

Root Cause

The root cause is missing output encoding when rendering the U2F Origin configuration value in the Web UI. The Proxmox interface treats the stored value as trusted content instead of applying context-aware HTML escaping. This maps directly to [CWE-79], where user-controlled input flows into an HTML sink without neutralization.

Attack Vector

An authenticated attacker with permission to modify datacenter settings navigates to the U2F configuration and submits a crafted payload in the Origin field. The payload is stored server-side. When another user, typically an administrator, opens the datacenter configuration page, the browser parses the injected content and executes attacker-controlled JavaScript. The attacker can then exfiltrate session tokens, issue authenticated API requests, or manipulate virtual machines and containers managed by the platform.

Technical proof-of-concept details are documented in the GitHub Proxmox XSS Bug Report.

Detection Methods for CVE-2025-57539

Indicators of Compromise

Unexpected HTML tags, <script> elements, or event handler attributes (onerror, onload) stored in the U2F Origin field of the datacenter configuration
Outbound requests from administrator browsers to unfamiliar domains shortly after loading the Proxmox Web UI
Anomalous API calls originating from administrator sessions immediately following Web UI access

Detection Strategies

Audit the Proxmox datacenter configuration file (/etc/pve/datacenter.cfg) for U2F Origin values containing HTML or JavaScript syntax
Inspect Web UI access logs for requests to datacenter configuration endpoints followed by unusual outbound browser traffic
Correlate authenticated user modifications to U2F settings with subsequent administrator session activity

Monitoring Recommendations

Enable and review Proxmox audit logging for configuration changes to two-factor authentication settings
Monitor administrator browser telemetry for script execution from the Proxmox management interface
Alert on new or unusual API tokens created shortly after Web UI sessions to catch post-exploitation persistence

How to Mitigate CVE-2025-57539

Immediate Actions Required

Upgrade Proxmox Virtual Environment to a patched release published after the Proxmox Security Advisory Forum notice
Review and sanitize the current U2F Origin value in the datacenter configuration and remove any content resembling HTML or JavaScript
Restrict datacenter configuration modification permissions to a minimal set of trusted administrators

Patch Information

Proxmox has addressed the issue through updates announced on the Proxmox Security Advisory Forum. Administrators running Proxmox VE 8.4 should apply the latest available packages via apt update && apt dist-upgrade and validate that the U2F Origin rendering path encodes output correctly after the upgrade.

Workarounds

Remove or blank the U2F Origin field until the environment is upgraded to a patched version
Enforce the principle of least privilege on datacenter roles to prevent low-privilege users from writing to two-factor configuration fields
Deploy a browser-level Content Security Policy at the reverse proxy fronting the Proxmox Web UI to restrict inline script execution

bash

# Upgrade Proxmox VE packages to receive the fix
apt update
apt dist-upgrade -y

# Inspect the current U2F Origin value for stored payloads
grep -i "u2f" /etc/pve/datacenter.cfg