Proxmox VE is a Debian-based virtualization platform that runs both KVM/QEMU virtual machines and LXC containers, administered through a web UI and REST API (the pvedaemon/pveproxy services on port 8006) and clustered with corosync. Its attack surface has three parts. The guest-to-host escape from a Proxmox VM is the QEMU device-model problem, inherited wholesale. The management plane, the API, web UI, and the pvesh/qm/pct tooling, controls every VM and container. And the storage backends (local directories, LVM, ZFS, Ceph) hold the VM disks and backups. LXC containers add the container-escape surface alongside the VM one.
# on a Proxmox node
qm list; pct list # KVM VMs and LXC containers
ss -tlnp | grep 8006 # the management web/API
pvecm status 2>/dev/null # cluster membership
Subtopics#
- Guest-to-host escape: breaking out of a Proxmox VM via QEMU.
- Host access and shell: execution on the Proxmox node.
- Management plane: the API, web UI, and cluster.
- Disk and backup theft: taking VM disks and vzdump backups.
- Known escape exploits: the inherited QEMU and platform bugs.