Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.
An attacker sends a login request with intentionally incorrect credentials, placing a malicious JavaScript snippet in the loginname parameter. Froxlor stores this value in system logs without proper sanitization. When the administrator views the logs in the admin panel, the script is rendered and executed in the context of their session (Stored Blind XSS). This allows the attacker to perform arbitrary actions on behalf of the administrator — for example, automatically adding a new administrator account under the attacker's control.
An attacker can gain full control of the Froxlor application by forcing the administrator to unknowingly perform malicious actions, such as creating a new account with administrator privileges. This results in loss of confidentiality, integrity, and availability of the managed server environment.
Froxlor should be updated to version 2.1.9 or later, in which the vulnerability has been fixed. The patch is available in the project's GitHub repository (commit a862307bce5cdfb1c208b835f3e8faddd23046e6).
Froxlor in versions prior to 2.1.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H