Plain text post request to proxmox VE

[xkpx]

I was curious to see if something bad happens in my network if my password can be stolen , and i tested with mitm attack to spy https traffic i see that the password for login field in proxmox-frontend [pve / pam] is send in plain text to the backend.
Is argon2 or some hashing implemented or someone need to pull request it?

 

[floh8]

you mean from the browser client to the webserver or from the web server to the backend?

 

[xkpx]

Browser client to the webserver

 

[fabian]

the only thing that would "protect" against is password reuse, which you really shouldn't do in 2023.. we need the password because depending on the realm, we need to pass it on (e.g. to PAM, or to LDAP/AD, ..) if it's not our backend that does the actual authentication.

furthermore, if we'd hash the password in the client, then an attacker could just steal/MITM the password hash and send it to the server and be authenticated - effectively, the hash becomes the password then. we do store the passwords hashed+salted in the backend, so that a compromise of the host doesn't directly expose all the passwords of the @pve realm.

 

[floh8]

wait. How it possible that a https connection surf unencrypted passwords - is the login form http?

 

[fabian]

no, pveproxy is only doing TLS (well, and since very recently, if you try to talk plain HTTP it will redirect you to TLS after parsing the headers). OP set up a MITM proxy (that requires either giving that proxy your cert+key, or trusting the MITM cert in the browser/client).

 

[floh8]

ah...this should mean "man in the middle". With SSL break. Now, i do not understand the question anymore.

 

[xkpx]

Question is just teoritical , example if someone breaks in office or get access to login machine and setup cert and proxy settings and just listening.. than bad stuff happens. You may say you got cams and prevent measure stuff , and still they are exploits,rats that are undetectable to windows so... and pass is in plain text sniffer by attacker. I was just curious

 

[fabian]

Question is just teoritical , example if someone breaks in office or get access to login machine and setup cert and proxy settings and just listening.. than bad stuff happens. You may say you got cams and prevent measure stuff , and still they are exploits,rats that are undetectable to windows so... and pass is in plain text sniffer by attacker. I was just curious

if your local system is compromised, having the client/browser somehow hash the password doesn't help in any way (the same thing is also true of the server, since the browser executes the JS code provided by the server).

 

[Dunuin]

Question is just teoritical , example if someone breaks in office or get access to login machine and setup cert and proxy settings and just listening.. than bad stuff happens.

Yeah, seen a review video of these totally generic looking hak5 USB cables a week ago with build-in keylogger, rubberducky, wifi for remote access, ... Wouldn't be that hard to gift employes some of those and hope that someone will use them to charge a phone with it using a client PC (or if not, you at least can get access to that emplyes phone ).