Executive brief
Froxlor is a web hosting control panel that manages domains, SSL certificates, and server configuration. A low-privileged customer can upload a malicious SSL certificate with crafted issuer information that executes JavaScript when an administrator views the certificate list, leading to complete administrator account takeover and potential root-level command execution on the managed server.
Technical details
Stored XSS in Froxlor's certificate management where the Certificates API stores the issuer organization field from parsed SSL certificates without sanitization, and the table-listing renderer outputs this field through Twig's raw filter, bypassing HTML escaping. A customer with domain management access can upload self-signed certificates with attacker-controlled issuer values that execute as JavaScript in an administrator's session; the vulnerability requires an authenticated customer account and admin interaction (viewing the SSL certificates page), but enables privilege escalation from customer to admin and further to root via cron-executed configuration changes. A fix is available in version 2.3.12.
Affected products
- Froxlor Froxlor 2.0.0 through 2.3.10
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 2.3.12