CVE-2026-62988

Executive Summary

CVE-2026-62988 is a high-severity information disclosure vulnerability affecting Froxlor, an open-source server administration panel, in versions 2.3.7 through 2.3.8. The flaw resides in the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands, where complete database rows are returned without stripping password and data_2fa fields. An authenticated attacker with access to these endpoints can exfiltrate password hashes and Base32-encoded TOTP seeds for customer, administrator, and FTP accounts, enabling offline cracking and full account takeover that defeats both authentication factors. The vulnerability carries a CVSS score of 9.0 and is fixed in version 2.3.8; however, patch coverage is unverified (0/4 confidence), and no public exploit or CISA KEV listing exists at the time of writing.

Technical Analysis

The vulnerability is fundamentally a failure to enforce output-level data masking in Froxlor’s internal API layer. The affected commands reside in three PHP files:

• lib/Froxlor/Api/Commands/Customers.php
• lib/Froxlor/Api/Commands/Admins.php
• lib/Froxlor/Api/Commands/Ftps.php

Specifically, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands retrieve full database rows from the underlying data storage and return them to the caller in their raw form. The expected behavior for such listing/view APIs is to apply a projection or sanitization step that removes sensitive columns—most critically the password hash column and the data_2fa column, which stores Base32-encoded TOTP seeds. Instead, the code returns all columns verbatim.

The attack mechanism is straightforward and does not require SQL injection or any bypass of authentication. An attacker only needs valid credentials for an account that has been granted permission to invoke these API endpoints. Because the API is network-accessible (CVSS vector AV:N), the attacker can authenticate from anywhere and issue these commands, retrieving sensitive data via a legitimate, albeit improperly sanitized, API call.

The severity is amplified by the synergy of the two exposed fields:

1. Password hashes — While the hashes are not plaintext, they are exposed in a form suitable for offline brute-force or dictionary attacks. Given the ubiquity of weak passwords in administrator and FTP accounts, a significant fraction of these hashes may be crackable with modest computational resources.

2. TOTP seeds (data_2fa) — Stored Base32-encoded TOTP seeds are functionally equivalent to burning the second-factor device. If an attacker obtains a seed, they can generate valid one-time codes for that account indefinitely (unless the seed rotates), effectively nullifying TOTP-based 2FA protections.

The combination of both values for a single account yields the ability to defeat both authentication factors—password (via cracking) and TOTP (via seed possession). This enables a "full takeover" scenario: the attacker can authenticate to the Froxlor panel as the victim, create or modify hosting plans, read configuration files, alter DNS records, or pivot to hosted resources such as websites and mailboxes managed by the panel.

Note that the CVSS vector assigns a PR:H (High Privileges Required) component to the attack preconditions, but the impact is rated C:H/I:H/A:L with a S:C (Scope Changed) modifier. The scope change reflects that compromise of the panel can lead to compromise of the underlying server and hosted resources, which are outside the original authorization scope. The A:L (Availability low) component likely reflects the minimal direct impact on service availability, though a full takeover could plausibly lead to higher availability impact in practice.

Due to limited public detail, the NVD description does not disclose whether the offending columns are explicitly named beyond password and data_2fa; nor does it clarify the exact hashing algorithm used. Insufficient technical detail is available regarding whether the fix (introduced in 2.3.8) applies column filtering or a global serialization sanitizer. Code-level confirmation beyond the file paths and command names listed above is not possible from the provided data.

Exploitation Scenarios

Reconnaissance & Target Identification

1. The attacker scans the internet for exposed Froxlor panels using Shodan or Censys queries such as "froxlor" or http.title:"Froxlor". Foxtrot panels are typically exposed on HTTPS port 443 or 8443 and are identifiable by their default login page. The attacker also may locate panels via SSL certificate transparency logs or by fingerprinting HTTP headers.

2. Because the vulnerable API endpoints require authentication, the attacker must acquire valid privileges. Common acquisition vectors include: (a) legitimate credentials obtained via phishing a panel administrator; (b) credentials harvested from previous data breaches; (c) default credentials if the panel operator did not change them (e.g., admin/admin); or (d) abuse of a second, unrelated vulnerability that yields administrative access to the panel.

3. Once authenticated, the attacker calls the Froxlor API. Note that the attacker does not need to have customer or admin privileges at the highest level—only the permission grants to invoke the listed commands. However, attaining at least a modest privilege role is necessary. The PR:H component of the CVSS vector indicates that high privileges are required, which aligns with the fact that these API endpoints are typically restricted to panel administrators rather than end customers.

Triggering the Vulnerability

4. The attacker invokes one of the affected commands, e.g., Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, or Ftps.listing, via the API. The precise API invocation format (POST/GET, JSON/XML) is not disclosed in the NVD description; however, the attacker uses whatever protocol Froxlor's API exposes. The essential point is that the command is executed as an authenticated request, and the server-side implementation returns the raw database row(s) without filtering.

Payload & Execution Mechanics

5. At the vulnerability-class level (improper output sanitization / CWE-200), no malicious payload is required beyond the authenticated API call itself. The attacker does not need to inject SQL, upload files, or exploit any memory corruption. The "exploit" is simply a query to an authorized-but-unsanitized interface. The response body of the API call will contain all database columns, including password and data_2fa.

6. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. Technical specificity beyond the aforementioned file paths and command names is not available.

Post-Exploitation Impact

7. The attacker harvests multiple credential material sets: (a) administrator panel password hashes; (b) customer account password hashes; (c) FTP account password hashes; and (d) Base32-encoded TOTP seeds (from data_2fa) for administrator and customer accounts.

8. The attacker runs an offline cracking campaign against the hashes. For common or weak passwords, the cracking succeeds quickly using hashcat or John the Ripper. For the TOTP seeds, the attacker imports the Base32 seed into a TOTP generator (e.g., Google Authenticator, oathtool) and thereby possesses valid 2FA codes for the accounts.

9. The attacker now performs a two-factor bypass: they log in to the Froxlor panel as the victim administrator using the cracked password and the valid TOTP code generated from the stolen seed. They then:

   • Create arbitrary hosting packages, subdomains, or mailboxes.
   • Modify or delete existing customer accounts.
   • Read configuration files containing other secrets (e.g., database credentials, SMTP passwords).
   • Potentially execute commands on the host server if Froxlor provides command-execution features (e.g., for package installation, DNS updates, etc.).
   • Pivot to hosted websites via panel-managed credentials and further lateral movement across the infrastructure.

10. The scope of impact extends beyond the Froxlor panel: any hosted resources (websites, databases, mailboxes) managed by the panel become accessible. The attacker can deface websites, exfiltrate customer data, use the panel for spam campaigns, or destroy availability by deleting resources. The scope is rated C:H/I:H/A:L in CVSS terms—confidentiality and integrity impact are high, while availability impact is limited but present.

11. If the attacker obtains a super-admin TOTP seed, they may also gain access to escalation rights that allow modification of panel-level settings, such as changing the master password, altering server-wide configurations, or even pivoting to the underlying OS via panel-integrated management tools.

Impact Assessment

Business Impact

• Credential Compromise of Admin & Customer Base: Exposure of password hashes for all customer, administrator, and FTP accounts. Even with low cracking efficiency, large panels could see broad account takeover.
• 2FA Defeat: The exposure of data_2fa values defeats the primary second-factor control for the entire panel, making the breach catastrophic for organizations that rely on TOTP as a compensating control.
• Reputation & Compliance: Likely to trigger breach notification requirements under GDPR, PCI DSS, or other regulatory regimes due to the exposure of authentication material that may lead to unauthorized access.
• Data Breach of Hosted Resources: Since Froxlor manages websites, mailboxes, and databases, attackers could directly access hosted customer data, worsening the breach scope.

Affected Systems

• All Froxlor installations running version 2.3.7 or earlier (versions in the range 2.3.7 up to but not including 2.3.8).
• Instances where the API has been enabled and where administrative or customer accounts have permissions to invoke the listed commands.
• Self-hosted panels that expose the Froxlor web interface to the internet or to a wide network segment.

Blast Radius

• CVSS 9.0 (Critical): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L. Network-exploitable, low attack complexity, requires high privileges, no user interaction; scope change; high confidentiality and integrity impact.
• EPSS: Not yet scored by FIRST.org; no probability-of-exploitation estimate is available.
• CISA KEV: Not listed; no evidence of in-the-wild exploitation at the time of writing.
• Patch Status: UNPATCHED (0/4) — although a fix is declared in version 2.3.8, this refers to the vendor’s release containing the fix; the PATCHED status from the CVE data indicates no independent confirmation from any tracked source. Administrators should treat this as an urgent but unverified fix.

Secondary Impact

• Lateral movement from panel compromise to hosted application infrastructure.
• Hosting provider brand damage and potential legal liability.
• Downstream client account compromise where the hosting provider is the immediate victim.

Detection Guidance

Detecting this vulnerability in the wild is complicated by the fact that the malicious action is an otherwise legitimate authenticated API call. However, the following detections can flag anomalies such as sudden bursts of large API responses, access to the listed endpoints by unusual users, or response bodies that include hashes.

Sigma Rule

title: Froxlor API Exposure of Password and TOTP Fields
id: 8d57a2b6-90c4-4f53-819a-1fd79042c5b7
status: experimental
description: Detects API requests to Froxlor Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing that may be used to exfiltrate password hashes and TOTP seeds.
author: Valters IT Threat Intelligence Team
date: 2026-02-20
logsource:
  category: web_application
  product: froxlor
  service: httpd
detection:
  selection_endpoints:
    cs-method:
      - POST
      - GET
    cs-uri-query|contains:
      - "Customers.get"
      - "Customers.listing"
      - "Admins.get"
      - "Admins.listing"
      - "Ftps.get"
      - "Ftps.listing"
      - "cmd=Customers.get"
      - "cmd=Customers.listing"
      - "cmd=Admins.get"
      - "cmd=Admins.listing"
      - "cmd=Ftps.get"
      - "cmd=Ftps.listing"
  selection_auth:
    sc-http-response-body|contains:
      - "password"
      - "data_2fa"
  condition: selection_endpoints and selection_auth
  timeframe: 5m
level: high
falsepositives:
  - Legitimate API usage by panel administrators for management tasks.	Tune by role and expected frequency.

YARA Rule

rule Froxlor_TOTP_Seed_Exfiltration
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-02-20"
        description = "Detects Froxlor API responses containing password and TOTP seed fields."
        reference = "CVE-2026-62988"
        score = 80
    strings:
        $s1 = "data_2fa" ascii wide nocase
        $s2 = "password" ascii wide nocase
        $s3 = "Customers.get" ascii wide nocase
        $s4 = "Admins.get" ascii wide nocase
        $s5 = "Ftps.get" ascii wide nocase
        $s6 = "Customers.listing" ascii wide nocase
        $s7 = "Admins.listing" ascii wide nocase
        $s8 = "Ftps.listing" ascii wide nocase
        $s9 = "$2y$" ascii wide
        $s10 = "otpauth" ascii wide nocase
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x5B22 // JSON array/object
        and 2 of ($s1, $s2, $s10)
        and 1 of ($s3, $s4, $s5, $s6, $s7, $s8)
}

rule Froxlor_AdminDump_Pattern
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-02-20"
        description = "Matches strings that look like Froxlor admin response containing bcrypt hash of format $2y$ and TOTP seed key."
    strings:
        $bcrypt = /\\\$2[ayb]\\$\\d{2}\\$[.\/A-Za-z0-9]{53}/ ascii
        $hexkey = /[A-Z2-7]{32}/ ascii // Base32 string of typical TOTP seed length
    condition:
        $bcrypt at 0 or $bcrypt in (0..filesize)
        and #hexkey > 2
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET WEB_SERVER Froxlor API Exfil of Password and TOTP fields (CVE-2026-62988)";
    flow:to_server,established;
    content:"GET"; http_method; nocase;
    content:"/admin_api.php"; http_uri; nocase;
    content:"Customers"; http_uri; nocase;
    content:"get"; http_uri; nocase;
    content:"cmd"; http_uri;
    depth:256;
    content:"password"; http_server_body; nocase;
    content:"data_2fa"; http_server_body; nocase;
    within:4096;
    classtype:attempted-info-leak;
    sid:20260201;
    rev:1;
    metadata:created_at 2026-02-20;
)

Note: The exact URI for the Froxlor API is not specified in the NVD description. The rule above uses a placeholder (admin_api.php); adjust to match the actual API endpoint observed in your environment.

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.action == "connection_accepted"]
  [http where
      http.request.method == "POST" and
      (url.path contains "Customers" or url.path contains "Admins" or url.path contains "Ftps") and
      (url.path contains "get" or url.path contains "listing") and
      http.response.bytes > 10000]
  [http where
      http.response.body contains "password" and
      http.response.body contains "data_2fa"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval isAdmin=lower(uri_path)
| where like(isAdmin, "%customers%") OR like(isAdmin, "%admins%") OR like(isAdmin, "%ftps%")
| where like(isAdmin, "%get%") OR like(isAdmin, "%listing%")
| rex field=_raw "(?i)(password.{0,100}data_2fa|data_2fa.{0,100}password)"
| search "CVE-2026-62988" OR "password" "data_2fa"
| table _time, src_ip, user, uri_path, http_status, bytes
| sort - _time

Wazuh OSSEC Rule

<group name="froxlor,">
  <rule id="100201" level="12">
    <decoded as="json">yes</decoded>
    <field name="event.module">apache_access</field>
    <match>Customers.get|Customers.listing|Admins.get|Admins.listing|Ftps.get|Ftps.listing</match>
    <regex>(?i)(password|data_2fa)</regex>
    <description>Froxlor API request/response exposing password and TOTP fields (CVE-2026-62988)</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>authentication, CVE-2026-62988</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 — UNPATCHED with respect to independent verification. The vendor has announced a fix in version 2.3.8, but no patch evidence from any tracked CVE source, vendor advisory, or OSV package has been confirmed. Treat the fix as unverified until it is independently confirmed.

Immediate Mitigations (short-term, before patch validation):

1. Disable or restrict API access — If the API endpoints (Customers, Admins, Ftps commands) are not business-critical, disable them entirely or restrict network access to trusted internal IP ranges only.
2. Harden authentication — Enforce strong MFA policies that do not rely solely on TOTP for Froxlor administrators. Use hardware tokens or WebAuthn if supported, since those secrets are not stored in the data_2fa column.
3. Rotate all secrets proactively — Even before applying the fix, force password resets and regenerate all TOTP seeds for all customers and administrators. This limits the value of any already-exfiltrated material.
4. Audit API logs — Review access logs for recent calls to the affected endpoints by any account. Assume compromise if unusual query patterns or large response sizes are observed; in that case perform a full credential rotation.
5. Isolate the panel — Move the Froxlor panel behind a VPN or reverse proxy with mutual TLS so that internet-facing access is eliminated.

Patch/Upgrade Steps (mid-term):

6. Upgrade to version 2.3.8 — The vendor states this version contains the fix. However, since patch confirmation is unverified (0/4), perform the upgrade in a staging environment first. Review the diff in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php before production deployment, if the source is available.
7. Confirm if the patch is actually applied — After upgrading, access one of the affected endpoints as a low-privilege authenticated user and verify that password and data_2fa fields are absent from the JSON response. If they are still present, do not treat the environment as patched and seek vendor support.
8. Check for backports — If the panel is deployed via a distribution package (e.g., apt, yum), verify the package version corresponds to 2.3.8 or later.

Long-Term Hardening:

9. Least privilege for API accounts — Ensure only the minimal set of accounts has permission to invoke Customers.get, Admins.get, Ftps.get, or their .listing counterparts. Consider adding a monitoring account that has no permission to these commands.
10. Network segmentation — Place the Froxlor panel in a demilitarized zone (DMZ) with strict egress controls and a web application firewall (WAF) that can inspect API request/response patterns.
11. Regular vulnerability scanning — Subscribe to NVD/CVE alerts for Froxlor and deploy a scanner that checks for this specific CVE once a stable detection signature (e.g., a bytecode-level check for the missing sanitizer) is available.
12. Log monitoring — Deploy the Sigma/Suricata/Elastic/Splunk detections above with a weekly review process to catch any post-patch regression or novel exfiltration attempt.
13. Hashing algorithm review — While outside the scope of this CVE, consider migrating panel password hashing to a memory-hard algorithm (e.g., Argon2id) to reduce offline cracking viability in the event of a similar future leak.

References

1. NVD Entry for CVE-2026-62988 — https://nvd.nist.gov/vuln/detail/CVE-2026-62988 (CVSS vector, CWE-200, description provided in this report).
2. Froxlor Project Website / Changelog — https://froxlor.org/ (Official project page; the 2.3.8 release is the stated fix. Verify the changelog for the exact fix commit.)
3. Froxlor GitHub Repository — https://github.com/Froxlor/Froxlor (Source for files lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, lib/Froxlor/Api/Commands/Ftps.php; use to diff the 2.3.7 vs 2.3.8 branches.)
4. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor — https://cwe.mitre.org/data/definitions/200.html (Weakness reference).
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-62988 is NOT listed as of February 2026; consult this source regularly for updates.)