CVE-2026-100720

Executive Summary

CVE-2026-100720 is a stored cross-site scripting (XSS) vulnerability in the Froxlor server management panel versions 2.0.0 through 2.3.10. A low-privileged authenticated customer can upload an SSL certificate containing a malicious issuer organization value, which is stored unsanitized and later rendered in the administrative "Domains > SSL certificates" listing without HTML escaping, executing script in a privileged administrator's or reseller's browser session. Successful exploitation crosses a privilege boundary from customer to administrator and, given Froxlor's administrative control over webserver, DNS, and PHP configuration applied by a root cron job, can be escalated to command execution as root on the managed server. The vulnerability is rated CVSS 8.7 (High) and is fixed in Froxlor 2.3.12.

Technical Analysis

The vulnerability resides in the certificate ingestion and rendering pipeline of Froxlor. When a customer—the lowest-privileged authenticated role—uploads an SSL certificate for one of their own domains, the Certificates API add() and update() methods parse the supplied certificate using PHP's openssl_x509_parse() function. The parsed issuer organization field, referenced as issuer['O'], is persisted verbatim to the database without sanitization or output encoding at write time.

The second half of the flaw is introduced at render time. Froxlor's table-listing renderer emits scalar table cells through the Twig template engine's raw filter, which explicitly disables Twig's default HTML auto-escaping. Consequently, when a privileged user navigates to the "Domains > SSL certificates" view, the stored issuer['O'] value is inserted into the HTML document as raw markup. Any HTML or JavaScript contained in that value is interpreted by the browser within the privileged user's authenticated session.

This is a classic stored (persistent) XSS chain that crosses a privilege boundary: the attacker requires only the PR:L (low-privileged, authenticated) customer role, while the victim is an administrator or reseller. The CVSS vector reflects this boundary crossing via S:C (Scope: Changed), and the high confidentiality and integrity impacts (C:H/I:H) because a Froxlor administrator session is a high-value target. Availability impact is A:N, as the attack does not directly degrade service availability; the CVSS 3.1 base score is 8.7, driven by network attack vector (AV:N), low attack complexity (AC:L), and required user interaction (UI:R) in the form of the administrator viewing the certificate listing.

The root cause is the missing context-appropriate output encoding—specifically, the misuse of a raw-emission primitive against data that is fully attacker-controlled and originates from a lower-privileged source. The stored value is not sanitized on input, not sanitized on output, and not constrained by any validation that would reject HTML metacharacters in the issuer organization field.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-100720; the attack chain below is inferred strictly from the vulnerability class (stored XSS via unsanitized, raw-rendered certificate metadata) and the details provided in the NVD description. No specific code patterns or undocumented function names are known to the public.

1. Reconnaissance and access acquisition. The attacker identifies a Froxlor instance running an affected version (2.0.0 through 2.3.10). Because exploitation requires an authenticated session, the attacker must first obtain a customer-level account, either by self-registering (if customer signup is enabled) or by compromising an existing low-privileged customer account. No special privileges beyond the customer role are required.

2. Crafting the malicious certificate. The attacker generates or modifies a valid X.509 certificate whose issuer organization field (issuer['O']) contains an XSS payload. Because the field is a free-form string, the attacker can embed HTML/JavaScript that will later be emitted via the raw filter. The certificate must remain structurally valid so that openssl_x509_parse() can parse it and the API add()/update() methods will store the attacker's value.

3. Storing the payload. Using the customer role, the attacker uploads the crafted certificate for a domain they control via the Certificates API add()/update() functionality. The issuer['O'] value is stored in the database verbatim, without sanitization, completing the persistence step. At this point, the payload is dormant in storage.

4. Triggering execution in the privileged session. An administrator or reseller later opens "Domains > SSL certificates." The listing renderer emits the stored issuer organization cell through Twig's raw filter, disabling auto-escaping so the attacker's markup is delivered as executable script. The payload executes in the context of the administrator's authenticated session, enabling actions such as session/token theft, creation of new admin accounts, modification of panel settings, or any state-changing request the administrator is authorized to perform.

5. Post-exploitation — from panel admin to root. Because a Froxlor administrator controls webserver, DNS, and PHP configuration that is applied by a cron job running as root on the managed server, the attacker who has taken over the administrator session can alter those managed configurations. The root cron job then applies the attacker-influenced configuration, escalating the compromise from a console-level admin takeover to command execution as root on the underlying server.

Impact Assessment

Successful exploitation yields a full crossing of the customer-to-administrator privilege boundary. The CVSS 3.1 subscores illustrate the severity:

• AV:N (Network): The vulnerable interface is reachable over the network; no adjacent or local access is needed.
• AC:L (Low): No specialized conditions or race windows are required; the certificate upload and the administrator's routine browsing of the certificate listing are sufficient.
• PR:L (Low): The attacker needs only the lowest-privileged authenticated role (customer).
• UI:R (Required): A privileged user must view the certificate listing for the payload to execute.
• S:C (Changed): The security scope changes—the compromise of the customer-controlled value affects the security context of a different, more privileged user.
• C:H / I:H: High confidentiality and integrity impact against the administrator session and, transitively, the managed server.
• A:N: No direct availability impact is attributed to the flaw itself.

The blast radius is significant. Froxlor is a multi-tenant server management panel; a compromised administrator account exposes all hosted domains, customer accounts, DNS zones, and the webserver/PHP configuration of the managed host. The ability to reach the root cron job that applies managed configuration elevates the impact from a web-panel compromise to full root-level control of the underlying server, affecting every tenant and service on that host. This makes the vulnerability attractive for establishing persistent, high-privilege footholds on shared hosting infrastructure.

Detection Guidance

Sigma Rule

title: Froxlor Stored XSS via Certificate Issuer Organization Field
id: 4f2c8b13-7a9e-4d21-9c6b-3e5a1d8f2b74
status: experimental
description: Detects HTTP requests that submit SSL certificate data to Froxlor certificate API endpoints, a vector for stored XSS via the issuer organization field (CVE-2026-100720).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100720
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1059.007
  - attack.initial_access
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_uri:
    cs-uri-stem|contains:
      - '/certificates'
      - '/api/'
  selection_body:
    cs-uri-query|contains:
      - 'certificate'
      - 'ssl'
      - 'issuer'
  condition: selection_method and selection_uri and selection_body
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate certificate uploads by administrators
level: medium

YARA Rule

rule CVE_2026_100720_Froxlor_Cert_XSS
{
    meta:
        description = "Detects XSS payloads embedded in PEM certificate data targeting Froxlor issuer organization field (CVE-2026-100720)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100720"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pem_begin = "-----BEGIN CERTIFICATE-----"
        $pem_end   = "-----END CERTIFICATE-----"
        $script1 = "<script" ascii nocase
        $script2 = "javascript:" ascii nocase
        $onerr   = "onerror=" ascii nocase
        $onload  = "onload=" ascii nocase
        $svg     = "<svg" ascii nocase
        $img     = "<img" ascii nocase

    condition:
        $pem_begin and $pem_end and any of ($script*, $onerr, $onload, $svg, $img)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100720 Froxlor Stored XSS via Certificate Issuer Organization"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"certificate"; nocase; http.request_body; content:"BEGIN CERTIFICATE"; http.request_body; pcre:"/(<script|onerror=|onload=|<svg|<img|javascript:)/i"; reference:cve,2026-100720; classtype:web-application-attack; sid:2026100720; rev:1;)

Elastic Detection

sequence by user.name with maxspan=30s
  [http where http.request.method == "POST" and
    wildcard(http.request.path, "*certificate*")]
  [http where http.request.method in ("POST", "PUT") and
    wildcard(http.request.body, "*BEGIN CERTIFICATE*") and
    wildcard(http.request.body, "*<script*")]

Splunk SPL Query

index=web OR index=proxy
| eval full=coalesce(uri, url, cs_uri_stem)
| where match(full, "(?i)certificate") OR match(full, "(?i)/api/")
| eval body=coalesce(request_body, body, cs_uri_query)
| where match(body, "(?i)BEGIN CERTIFICATE") AND match(body, "(?i)(<script|onerror=|onload=|<svg|<img|javascript:)")
| stats count values(clientip) as src_ips values(user) as users by full body
| where count > 0
| table _time full src_ips users count body

Wazuh OSSEC Rule

<group name="web,froxlor,xss,">
  <rule id="100720" level="10">
    <decoded_as>json</decoded_as>
    <match>certificate</match>
    <match>BEGIN CERTIFICATE</match>
    <regex type="pcre2">(?i)(&lt;script|onerror=|onload=|&lt;svg|&lt;img|javascript:)</regex>
    <description>CVE-2026-100720: Possible Froxlor stored XSS payload in certificate upload (issuer organization field)</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is currently available from tracked sources; the description references an eventual fix in Froxlor 2.3.12, which should be treated as the target version pending confirmation.

1. Immediate mitigations.

   • Restrict who can upload SSL certificates, or temporarily disable customer certificate uploads until the panel is upgraded.
   • Ensure HTML output encoding is enforced for all certificate metadata rendered in the certificate listing; audit use of the Twig raw filter and remove it where attacker-controlled data is emitted.
   • Sanitize or reject HTML metacharacters in the issuer organization field at ingestion time as a compensating control.
   • Constrain administrative viewing of "Domains > SSL certificates" behind additional controls and reduce standing admin privileges where possible.

2. Patch/upgrade steps.

   • Upgrade Froxlor to version 2.3.12 or later once the fix is confirmed and available from the vendor.
   • Verify the upgrade against the "Domains > SSL certificates" rendering path and confirm that issuer values are HTML-escaped after patching.

3. Long-term hardening.

   • Adopt contextual output encoding as a default practice, and treat use of raw-emission primitives against user data as a code-review red flag.
   • Enforce Content Security Policy on the Froxlor panel to reduce the impact of any residual script injection.
   • Apply least-privilege to panel roles and separate the high-privilege functions (webserver, DNS, PHP config applied by the root cron job) from routine administration.
   • Add regression tests covering certificate metadata rendering with malicious issuer values.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100720
• Froxlor project site and changelog (fix referenced in release 2.3.12): https://froxlor.org
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007: https://attack.mitre.org/techniques/T1059/007/
• CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• CISA KEV Catalog (not currently listed; status checked): https://www.cisa.gov/known-exploited-vulnerabilities-catalog