Froxlor versions from 0.10.0 up to but not including 2.3.14 contain a newline injection vulnerability in the Ftps.add API. Authenticated users can exploit this flaw by injecting newline characters into the additional_members parameter, which are then unsanitized when written to the root-owned NSS group database file. This can create unauthorized privileged group entries, enabling local privilege escalation. The vulnerability is fixed in version 2.3.14.
Froxlor versions prior to 2.3.12 have a vulnerability in the DirProtections.listing API command that allows authenticated API users to retrieve bcrypt password hashes from htpasswd files. This exposure enables offline cracking attempts and risks credential reuse compromise.
Froxlor versions 2.0.0 through 2.3.10 contain a stored cross-site scripting (XSS) vulnerability. This occurs when a customer uploads an SSL certificate, and the issuer organization field is stored without sanitization. The vulnerability allows attacker-supplied script to execute in the session of privileged users such as administrators or resellers. Exploitation can lead to full administrator account takeover and potential root command execution on the managed server. The issue is resolved in Froxlor version 2.3.12.
Froxlor versions through 2.3.10 have an issue where sensitive columns, specifically the dkim_privkey field, are not filtered from API responses in certain domain-related API calls. This allows authenticated non-superadmin admins with the delegated customers_see_all flag to access DKIM private keys of other tenants' domains. The vulnerability enables unauthorized reading of private signing keys, which could be used to sign emails that pass DKIM verification and DMARC alignment. The issue was fixed in version 2.3.12.
froxlor versions up to 2.3.10 contain a vulnerability where an unauthenticated GET request to the two-factor authentication (2FA) management page disables a user's 2FA without confirmation or re-authentication. This occurs because the global CSRF protection does not cover GET requests, and the session cookie's SameSite=Lax setting allows cross-site navigation to carry the session, enabling silent 2FA disablement. Both customer and admin 2FA handlers are affected. The issue is fixed in version 2.3.12.
Froxlor versions 2.3.10 and earlier have a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron job. This flaw allows a local user with shell access to exploit a race between symlink validation and file write operations, potentially leading to root-level compromise of the host running the Froxlor panel. The vulnerability is fixed in version 2.3.12.
Froxlor versions up to and including 2.3.10 have a critical vulnerability where the system.letsencryptchallengepath setting is not properly restricted or escaped. This allows an administrator or any actor able to write settings to inject arbitrary command-line options into the acme.sh command executed by root via cron, leading to arbitrary command execution or file writes as root. The issue is fixed in version 2.3.12.
Froxlor versions up to 2.3.10 have a vulnerability where the mail.allow_external_domains policy is not enforced in the EmailSender.add API command. This allows an authenticated customer with API access to register arbitrary external sender addresses despite policy settings that should prevent this. The issue creates a bypass between the administrator UI configuration and the API, enabling sender spoofing by authorizing sender identities outside the hosted domains. The vulnerability is fixed in version 2.3.12.
Froxlor versions through 2.3.10 have a vulnerability in their two-factor authentication (2FA) remembered-token mechanism. The system stores only a numeric user ID in remembered-2FA tokens without recording the account namespace, causing token lookups to be ambiguous between customer and administrator accounts. This allows an attacker who controls a customer account with a colliding ID and a valid remembered-2FA token, and who knows the administrator's password, to bypass the administrator's TOTP second factor and gain an authenticated administrator session. This vulnerability affects only the second-factor authentication step and does not bypass password authentication. The issue is fixed in version 2.3.12.
In froxlor versions 2.3.10 and earlier, the URL validation function Validate::validateUrl does not properly inspect the userinfo component of URLs for carriage return and line feed characters. This allows an authenticated low-privilege user with subdomain creation rights to inject malicious payloads into the web server configuration. The injected directives can execute with root privileges, enabling server-wide impact such as response hijacking or local file reading. The vulnerability is fixed in version 2.3.12.
Froxlor versions before 2.3.13 expose the raw PEM TLS private key content in JSON API responses for certificate-related commands. This occurs because the ssl_key_file column is returned verbatim without filtering, allowing low-privileged authenticated API users to access private keys of their own domains. Reseller and admin accounts with broader privileges can access private keys of other users. Exposure of these private keys can lead to domain impersonation, passive decryption of TLS traffic, and man-in-the-middle attacks.
Froxlor versions through 2.3.10 contain a vulnerability allowing authenticated users with write access to an FTP home directory to cause arbitrary file deletion via symlink following in a root-executed cron task. This occurs because the FTP data deletion cron job improperly handles symlinks, leading to potential cross-tenant data destruction and denial of service. The issue is resolved in Froxlor version 2.3.12.
Froxlor versions 2.3.10 and earlier contain a critical vulnerability in the customer data-export cron job. The vulnerability arises from improper validation of intermediate path components in the export destination, allowing an authenticated customer to create symlinks that cause the cron job to recursively change ownership of arbitrary directories, including sensitive system paths. This can lead to host root and cross-tenant compromise. The issue is fixed in Froxlor version 2.3.12.
froxlor versions before 2.3.12 do not invalidate existing panel sessions, API keys, and 2FA trust cookies when a user changes their password. This allows attackers who have hijacked sessions or possess valid API keys or 2FA trust tokens to maintain full account access even after password rotation, effectively bypassing incident response measures.
CVE-2024-58383 is a vulnerability in Froxlor versions up to and including 2.2.0-rc3 where the file /etc/pure-ftpd/db/mysql.conf is created with insecure permissions (0644). This file contains the Froxlor SQL user's password, allowing any unprivileged local user with code execution capabilities to read it. Exploiting this, an attacker can access the database, modify administrator credentials, and escalate privileges to root. Only Froxlor instances configured to use pure-ftpd are affected.
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue.