GHSA-ch7m-649m-x7xg: Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILDVHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.15
Event History
Frequently Asked Questions
Who can exploit this issue?
A customer with API access can exploit it. The issue affects the Certificates.add and Certificates.update API commands when they are used against a domain whose certificate is managed by Let's Encrypt.
What does an attacker need to do for the certificate to reach the webserver?
The attacker can replace the managed certificate and private key with an attacker-chosen pair through the API. A REBUILD_VHOST task then deploys that pair to the webserver.
How can administrators tell whether they may have been affected?
Review certificate changes made through the Certificates.add and Certificates.update API commands for Let's Encrypt-managed domains, and inspect the certificate and private key currently deployed after REBUILD_VHOST tasks. Unexpected certificate/key pairs or disrupted ACME automation are indicators of impact.