Two days ago, my Proxmox VE 7 installation, which was over four years old with the latest updates available up to EOL and only one user (root), was encrypted, and a ransom was demanded for decryption. I searched online for the ransom note and found someone complaining in Chinese about the same thing 1 day ago, which seems to be a wave of some kind of zero-day or RCE without authentication. All the logs were deleted by the attackers. There was an IP address sending requests to a specific endpoint in the last logs after they were deleted, but I'm not sure if it's the attacker's server. I can provide more details to the administrators if needed, but it seems there's some kind of exploit in the wild affecting all Proxmox VE 7 installations exposed to the internet, regardless of their configuration.
Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth
- Thread starter pve7bug
- Start date
Sorry for your loss, but why would anyone do that?
Thank you for reminding people to regularly upgrade their software (and not run unsupported versions). I do hope you can recover from backups on a fresh (and supported) Proxmox.
There is a section in the PBS manual about ransomware: https://pbs.proxmox.com/docs/storage.html#ransomware-protection-recovery
There is a section in the PBS manual about ransomware: https://pbs.proxmox.com/docs/storage.html#ransomware-protection-recovery
Honestly, I didn't remember that this Proxmox installation was exposed to the internet, but I suppose that while traveling I disabled the firewall rules for convenience so I could access it freely. I wasn't aware that, despite being end-of-life, this version was vulnerable to some kind of non-authentication attack. I wasn't overly worried, though, since I was the only user with a password longer than 30 random characters.
Without a firewall and especially security updates they probably don't need any account or password. Maybe they entered via a VM or container? Exploits for those have been reported recently: https://forum.proxmox.com/forums/security-advisories.26/
Ironically, all the virtual machines were closed with a firewall, and the services weren't publicly accessible except through Cloudflare, with access only through Cloudflare's IPs. I'm 100% sure it's a non-auth exploit in PVE 7, perhaps a zero-day. Nothing else was exposed except the Proxmox server itself, which only had one user (root) and a generated password, so the chances of a brute-force attack are zero (the password was longer than 30 characters, included special characters, and was unique to this server).
PVE 7 and the Debian version it sits on went end of life over two (corrected from three) years ago. The list of vulnerabilities discovered and patched since then is going to be a mile long.
It would even be a bad idea to expose a fully patched PVE 9 host to the Internet, since it's not specifically hardened for such a situation.
Also, unless you were using a properly signed certificate, the traffic may not have been encrypted sufficiently while you were travelling, so there may have been some kind of man in the middle compromise when you entered your password to log in.
Regardless, PVE 7 and Debian 11 are far in the past of support, so even if there was a new exploit, it would likely not get any attention or a fix.
It would even be a bad idea to expose a fully patched PVE 9 host to the Internet, since it's not specifically hardened for such a situation.
Also, unless you were using a properly signed certificate, the traffic may not have been encrypted sufficiently while you were travelling, so there may have been some kind of man in the middle compromise when you entered your password to log in.
Regardless, PVE 7 and Debian 11 are far in the past of support, so even if there was a new exploit, it would likely not get any attention or a fix.
Last edited:
The Linux kernel has had at least 500 CVE's fixed per release (before LLMs) and your PVE 7 kernel (5.15?) is many version behind, so either one could potentially be the entry point. Whether you had a good password is irrelevant. Proxmox fixed security issues in their kernels (and Debian in SSH and other software) many times in between, but only on supported versions. EDIT: Some of the SSH security holes were big news on the internet in the past few years (during which you did not update).
Last edited:
So, you are:
If this is not a troll, I hope the lesson was learned...
- Running a OS that is EOL since two years
- Exposing it to the internet
- Disabling the firewall
If this is not a troll, I hope the lesson was learned...
In addition what others already said about patching, no additional security on ports and running EOL software, you should also considering monitor all internet-facing stuff in order to detect non-normal behaviour, e.g. I use on some sites mTLS authentication and I monitor if the page can be accessed without a certificate, so that I know, that my added security measurement is not working anymore.
My sole intention in making this post is to report something that's happening to all Proxmox VE 7 systems exposed to the internet, since there's a zero-day vulnerability in the wild. I'm aware of the "danger" of exposing Proxmox to the internet (even though it wasn't intentional). Most comments respond as if it were common for a clean installation of Debian 11 (EOL) to be as easy to hack as pressing a key on a keyboard simply because it's exposed to the internet. I think they're unaware that 70% of the internet and critical systems run on EOL versions and are also exposed to the internet, but that doesn't mean they're suddenly hacked without any local user access. 99% of kernel exploits are vulnerabilities exploited with a local user without privileges, not non-auth RCE.
I'm aware of my mistake; I'm not a troll, and I'm just warning others so they're aware of the situation. I have backups and my systems are back online (on Proxmox VE9 this time... lol)
I'm aware of my mistake; I'm not a troll, and I'm just warning others so they're aware of the situation. I have backups and my systems are back online (on Proxmox VE9 this time... lol)
I wish that nobody was still running PVE 7 and I really hope they don't run it in the same way. It's not news because there are known vulnerabilities against PVE 7 (and the Linux kernel and SSH and other software that old) and it's very likely that they are actively being used to attack Linux servers attached to the internet. But thank you for reminding people to upgrade. Glad to hear your backups were still good.
I've seen a similar post on another forum very recently about Proxmox 8 too (from what I understand the user was running a very early version 8 install, maybe 2-3 years old, close to launch date)..
I guess the worry always with these things is if the vulnerability somehow exists in the newer versions too .. without it being disclosed publically by the attacker.
I guess the worry always with these things is if the vulnerability somehow exists in the newer versions too .. without it being disclosed publically by the attacker.
Gilberto Ferreira
Famous Member
PVE 8 is EOL too. Even if it's not affected this time, Kernel vulnerabilities are found almost every week.
It's just a matter of time.
It's just a matter of time.
Last edited:
From what I've seen on another forum Proxmox 8 is affected, it was a early version 8 (8.0.2?) or similar if I recall correctly.
Search for
8. in these posts here: https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/ . PVE 8 is also vulnerable to lots of things unless completely up to date but it most likely does not get any updates anymore, so it will get worse (but probably not reported anymore as it is End Of Life). EDIT: And then there is Debian 12, which is EOL and has known vulnerabilities in SSH and other software.
Last edited:
Gilberto Ferreira
Famous Member
I got reports from Proxmox VE 8.0.3, 8.2 and 8.4 as well...
And here is a compromissed server:
And here is a compromissed server:
Last edited:
Gilberto Ferreira
Famous Member
In any case, I don't think this is a 0day vulnerability, because on this is happen due to out date servers and bad servers administration, to say the least.
Many of this vulnerabilities are well-know documented, such as kernel and ssh vulnerabilities.
So, your job is do not exposed a weak server to the internet, and if you need do this, take all the necessary precations, like VPN, or have your servers up to date, continuosly.
Just do your job.
Many of this vulnerabilities are well-know documented, such as kernel and ssh vulnerabilities.
So, your job is do not exposed a weak server to the internet, and if you need do this, take all the necessary precations, like VPN, or have your servers up to date, continuosly.
Just do your job.
Last edited: