GHSA-6vjr-55fw-r5x2: Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customerhideoptions check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.15
Event History
Frequently Asked Questions
Who is exposed to this issue?
Froxlor deployments before 2.3.15 are affected where customers can authenticate to the panel. The issue is relevant when an administrator has disabled the MySQL feature for customers but customer accounts still have access to invoke the Mysqls.add API endpoint.
What does an attacker need to exploit it?
An attacker needs valid customer-level authentication. No user interaction is required, and the attacker can call the Mysqls.add API endpoint to create databases within their own quota.
Does disabling the MySQL feature prevent exploitation?
No. The vulnerable endpoint lacks the customer_hide_options check, so authenticated customers can still invoke Mysqls.add even when the administrator has disabled the MySQL feature.
How can I tell whether unauthorized database creation may have occurred?
Review MySQL database creation activity and compare created databases against the configured customer MySQL policy. Focus on databases created by customer accounts while the MySQL feature was disabled, noting that creation remains limited to the customer's quota.