Executive brief
Froxlor is a hosting control panel that provides an API for administrative and customer account management. Several API endpoints (Customers.get/listing, Admins.get/listing, and Ftps.get/listing) return password hashes and TOTP 2FA seed material in JSON responses without filtering, allowing authenticated API users to retrieve and potentially crack password hashes or generate valid 2FA codes for customer, administrator, and FTP accounts. This could lead to account takeover and unauthorized access to hosting infrastructure and hosted content.
Technical details
The vulnerability is an information disclosure flaw in the Froxlor API command classes (Customers.php, Admins.php, and Ftps.php) that fail to filter sensitive fields before returning API responses. The affected endpoints execute database queries that retrieve entire rows (SELECT *) and return results directly via $this->response(...) without stripping credential material. Exposed fields include password hashes (Bcrypt-hashed passwords) for customers, administrators, and FTP users, as well as Base32-encoded TOTP 2FA seeds (data_2fa field) for administrator and customer accounts. Authentication is required to call these endpoints (API key and secret), but the vulnerability allows any authenticated API user to retrieve credentials for all visible accounts. An attacker can perform offline password hash cracking and/or use exposed TOTP seeds to generate valid six-digit codes for second-factor bypass. The patch (version 2.3.8) removes or redacts these sensitive fields before returning responses.
Affected products
- Froxlor Froxlor < 2.3.8
Timeline
- 2026-06-29: disclosed: Published in GitHub Advisory Database
- 2026-08-18: advisory: Advisory updated
- 2026-06-29: patched: Fixed in version 2.3.8
References
- https://api.github.com/users/muhammadahmad62
- https://github.com/muhammadahmad62
- https://api.github.com/users/muhammadahmad62/gists%7B/gist_id%7D
- https://api.github.com/users/muhammadahmad62/repos
- https://avatars.githubusercontent.com/u/56760389?v=4
- https://api.github.com/users/muhammadahmad62/events%7B/privacy%7D