GHSA-5fm2-8wxf-xc5v: Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Froxlor versions from 2.3.8 up to, but not including, 2.3.15 are affected. Exploitation requires an administrator account that has the customers_see_all permission.
What does an attacker need to obtain super administrator control?
An attacker must authenticate as an administrator with customers_see_all, access api_keys.php, and view the API-key detail modal. They can retrieve the super administrator's API key and secret and replay those credentials to the API.
How can I determine whether credentials may already have been exposed?
Review whether any administrator accounts with customers_see_all accessed the API-key listing or detail modal while running an affected version. Because the issue exposes API keys and secrets, treat the super administrator API credentials as potentially compromised if such access cannot be ruled out.