Froxlor API authorization gaps bypass certificate and database limits
Customers of a web hosting control panel can slip past admin limits.
Summary
Froxlor's hosting control panel API lacks authorization checks, so customers can replace Let's Encrypt certificates and private keys or create MySQL databases the admin disabled. Versions 2.3.0 through 2.3.14 are affected, and some admin accounts can also see other accounts' API keys.
Affected when
- Customer API access enabled
- Domain using Let's Encrypt automatic certificates
- Admin has hidden the MySQL feature from customers
- Admin account with customers_see_all
What to do
Update to Froxlor 2.3.15.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen