CyberRota Analysis
AI-GeneratedFroxlor versions prior to 2.3.8 are vulnerable due to a lack of proper CSRF token validation in the editapikey action, allowing unauthenticated attackers to exploit this weakness by tricking authenticated administrators into submitting forged requests. This can lead to unauthorized modifications of API key settings, potentially compromising the security of the server. Organizations using Froxlor should prioritize upgrading to version 2.3.8 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.