CVE-2025-57540 Overview
CVE-2025-57540 is a stored cross-site scripting (XSS) vulnerability affecting Proxmox Virtual Environment (PVE) 8.4. The flaw resides in the WebAuthn Relying Party field within the Datacenter configuration. Authenticated users with access to the configuration interface can inject JavaScript payloads that persist server-side. The payloads execute in the browser context of any user who subsequently views the affected configuration page. This enables client-side attacks including session token theft, credential harvesting, and unauthorized administrative actions performed on behalf of the victim. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated attackers can inject persistent JavaScript into the Proxmox Datacenter WebAuthn configuration, executing arbitrary script in the browsers of administrators viewing the page.
Affected Products
- Proxmox Virtual Environment 8.4
- Proxmox Datacenter WebAuthn Relying Party configuration field
- PVE web management interface
Discovery Timeline
- 2025-09-09 - CVE-2025-57540 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57540
Vulnerability Analysis
The vulnerability exists in the Proxmox Virtual Environment web interface, specifically in the WebAuthn Relying Party configuration field under Datacenter settings. Proxmox stores the field value without sufficient output encoding when the configuration page is later rendered. When an administrator navigates to the Datacenter configuration view, the browser interprets attacker-supplied markup as executable script.
Exploitation requires an authenticated user with permission to modify the Datacenter WebAuthn settings. User interaction is required because a victim must load the configuration page for the payload to execute. Because scripts run in the Proxmox management interface origin, an attacker can perform any action available to the victim's session, including modifying virtual machines, extracting API tokens, or pivoting to hosted workloads.
Root Cause
The root cause is improper neutralization of user-supplied input in the WebAuthn Relying Party field. The Proxmox web UI fails to HTML-encode or sanitize the stored value before injecting it into the rendered configuration page. This allows arbitrary HTML and JavaScript to be persisted and later executed in the DOM of authenticated administrators.
Attack Vector
An authenticated attacker with configuration privileges submits a malicious payload into the WebAuthn Relying Party field. The payload is saved to the Datacenter configuration and served to any subsequent viewer. The scope change reflects that the executed script operates against the administrator's browser context, breaking the security boundary of the low-privilege attacker session. Refer to the Proxmox Security Advisory Discussion and the GitHub Proxmox XSS Bug Report for exploitation details.
Detection Methods for CVE-2025-57540
Indicators of Compromise
- Unexpected HTML tags, <script> elements, or JavaScript event handlers stored in the Datacenter WebAuthn Relying Party field.
- Modifications to /etc/pve/datacenter.cfg containing non-alphanumeric characters in the webauthn configuration block.
- Anomalous outbound requests from administrator browsers immediately after loading the Datacenter configuration page.
Detection Strategies
- Audit the Proxmox Datacenter configuration file for WebAuthn field values containing HTML control characters such as <, >, or quote marks.
- Review Proxmox task logs (pvesh get /cluster/tasks) for configuration changes to the WebAuthn Relying Party setting.
- Deploy Content Security Policy (CSP) reporting endpoints to capture inline script violations originating from the PVE UI.
Monitoring Recommendations
- Enable logging of all Datacenter configuration edits and correlate them with authenticated user sessions.
- Monitor low-privilege PVE accounts that gain access to Datacenter-level configuration endpoints.
- Alert on browser telemetry indicating script execution from unexpected Proxmox management URLs.
How to Mitigate CVE-2025-57540
Immediate Actions Required
- Inspect the WebAuthn Relying Party field in Datacenter settings and remove any values containing HTML or script content.
- Restrict Sys.Modify and Datacenter configuration privileges to trusted administrators only.
- Rotate API tokens and administrative credentials if suspicious configuration changes are identified.
Patch Information
Proxmox has acknowledged the issue through its security advisory channel. Consult the Proxmox Security Advisory Discussion for the fixed package versions and upgrade guidance. Apply updates via apt update && apt dist-upgrade on affected PVE 8.4 nodes and restart the pveproxy service to load the patched web interface.
Workarounds
- Limit access to the Datacenter configuration menu using Proxmox role-based access control until patches are applied.
- Enforce a strict browser Content Security Policy that blocks inline script execution in the Proxmox UI origin.
- Require multi-factor authentication for all accounts holding Datacenter modification privileges to reduce abuse of stolen sessions.
# Configuration example: restrict Datacenter modification permissions
pveum role add RestrictedAdmin -privs "VM.Audit,Datastore.Audit"
pveum acl modify / -user operator@pve -role RestrictedAdmin
# Inspect current WebAuthn configuration for injected content
grep -i webauthn /etc/pve/datacenter.cfg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
