csaf_certbund - WID-SEC-W-2024-1169

WID-SEC-W-2024-1169

Vulnerability from csaf_certbund

Published

2024-05-15 22:00

Modified

2024-05-15 22:00

Summary

Froxlor: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Froxlor ist eine Web-basierte Server-Management-Software.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Froxlor ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

Betroffene Betriebssysteme

- Linux

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         text: "hoch",
      },
      category: "csaf_base",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "de-DE",
      notes: [
         {
            category: "legal_disclaimer",
            text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.",
         },
         {
            category: "description",
            text: "Froxlor ist eine Web-basierte Server-Management-Software.",
            title: "Produktbeschreibung",
         },
         {
            category: "summary",
            text: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Froxlor ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.",
            title: "Angriff",
         },
         {
            category: "general",
            text: "- Linux",
            title: "Betroffene Betriebssysteme",
         },
      ],
      publisher: {
         category: "other",
         contact_details: "csaf-provider@cert-bund.de",
         name: "Bundesamt für Sicherheit in der Informationstechnik",
         namespace: "https://www.bsi.bund.de",
      },
      references: [
         {
            category: "self",
            summary: "WID-SEC-W-2024-1169 - CSAF Version",
            url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1169.json",
         },
         {
            category: "self",
            summary: "WID-SEC-2024-1169 - Portal Version",
            url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1169",
         },
         {
            category: "external",
            summary: "Froxlor Github vom 2024-05-15",
            url: "https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53",
         },
         {
            category: "external",
            summary: "Security Online vom 2024-05-15",
            url: "https://securityonline.info/froxlor-web-hosting-control-panel-vulnerable-to-remote-compromise-cve-2024-34070/",
         },
      ],
      source_lang: "en-US",
      title: "Froxlor: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten",
      tracking: {
         current_release_date: "2024-05-15T22:00:00.000+00:00",
         generator: {
            date: "2024-08-15T18:09:07.142+00:00",
            engine: {
               name: "BSI-WID",
               version: "1.3.5",
            },
         },
         id: "WID-SEC-W-2024-1169",
         initial_release_date: "2024-05-15T22:00:00.000+00:00",
         revision_history: [
            {
               date: "2024-05-15T22:00:00.000+00:00",
               number: "1",
               summary: "Initiale Fassung",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<2.1.9",
                        product: {
                           name: "Open Source Froxlor <2.1.9",
                           product_id: "T034873",
                        },
                     },
                  ],
                  category: "product_name",
                  name: "Froxlor",
               },
            ],
            category: "vendor",
            name: "Open Source",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-34070",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in Froxlor. Beim Anmeldeversuch können bösartige Skripte in den Parameter loginname eingefügt werden, die ausgeführt werden, wenn andere Benutzer auf die betroffene Seite zugreifen. Wenn ein Administrator die entsprechenden Systemprotokolle ausliest, kann diese XSS Schwachstelle von einem entfernten anonymen Angreifer ausgenutzt werden, um beliebigen Code als Admin zur Ausführung zu bringen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.",
            },
         ],
         release_date: "2024-05-15T22:00:00.000+00:00",
         title: "CVE-2024-34070",
      },
   ],
}

cve-2024-34070

Vulnerability from cvelistv5

Published

2024-05-10 15:21

Modified

2024-08-02 02:42

Severity ?

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.

References

▼	URL	Tags
	https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53	x_refsource_CONFIRM
	https://github.com/froxlor/Froxlor/commit/a862307bce5cdfb1c208b835f3e8faddd23046e6	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	froxlor	Froxlor	Version: < 2.1.9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:froxlor:froxlor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "froxlor",
                  vendor: "froxlor",
                  versions: [
                     {
                        lessThan: "2.1.9",
                        status: "affected",
                        version: "2.1.9*",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-34070",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-10T20:22:17.320471Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:42:49.031Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T02:42:59.890Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53",
               },
               {
                  name: "https://github.com/froxlor/Froxlor/commit/a862307bce5cdfb1c208b835f3e8faddd23046e6",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/froxlor/Froxlor/commit/a862307bce5cdfb1c208b835f3e8faddd23046e6",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Froxlor",
               vendor: "froxlor",
               versions: [
                  {
                     status: "affected",
                     version: "< 2.1.9",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs.  By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.7,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-80",
                     description: "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-10T15:21:37.883Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53",
            },
            {
               name: "https://github.com/froxlor/Froxlor/commit/a862307bce5cdfb1c208b835f3e8faddd23046e6",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/froxlor/Froxlor/commit/a862307bce5cdfb1c208b835f3e8faddd23046e6",
            },
         ],
         source: {
            advisory: "GHSA-x525-54hf-xr53",
            discovery: "UNKNOWN",
         },
         title: "Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-34070",
      datePublished: "2024-05-10T15:21:37.883Z",
      dateReserved: "2024-04-30T06:56:33.381Z",
      dateUpdated: "2024-08-02T02:42:59.890Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted