Executive brief
Froxlor is a hosting management control panel used by ISPs to manage multiple customer domains and DNS records. A stored cross-site scripting (XSS) vulnerability in the DNS editor allows a customer with basic DNS editing privileges to inject malicious code that executes in administrators' browsers when they view DNS settings. An attacker could exploit this to steal admin session cookies, create backdoor administrator accounts, access all customer data, or compromise the entire hosting server.
Technical details
The vulnerability stems from three converging failures: (1) Input validation at `DomainZones.php:158` only strips non-printable characters but leaves HTML special characters like < and > intact; (2) the display callback at `Text.php:95` returns wordwrapped text without HTML escaping; (3) the Twig template at `table.html.twig:57` renders the callback output with the `|raw` filter, bypassing auto-escaping. An attacker with DNS editor privileges (typically customer-level access) can inject a payload like `<img src=x onerror=alert(document.domain)>` into any TXT record. The payload executes automatically when any logged-in administrator navigates to the domain's DNS editor page—no user interaction beyond page navigation is required. The CSP header includes `'unsafe-inline'` and `'unsafe-eval'`, rendering it ineffective as a mitigation. A real exploit would exfiltrate admin session cookies to create backdoor accounts or execute arbitrary commands through Froxlor's system interface.
Affected products
- Froxlor Froxlor <= 2.3.7
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory published
- 2026-08-18: patched: Fix released in version 2.3.8