Description
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
froxlor froxlor
Default version status: unaffected
0.10.0 to < 2.3.15affected
pkg:composer/froxlor/froxlorReferences
- https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv ↗
- https://github.com/froxlor/froxlor/commit/078e3f4ba0429390b27baae6aa1cc5d8c9a80010 ↗
- https://github.com/froxlor/froxlor/releases/tag/2.3.15 ↗
- https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/SubDomains.php#L1161-L1211 ↗
- https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-missing-authorization-via-subdomains-delete-api ↗