Patchfirst
Patchfirst
CVE-2023-2034 Critical · 9.1 EPSS 71.4%

Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

froxlor · froxlor/froxlor

Summary

Froxlor/froxlor, the open-source web hosting control panel, contains an unrestricted file upload flaw (CWE: Unrestricted Upload of File with Dangerous Type) in versions prior to 2.0.14. An attacker who has high-privilege authentication to the application over the network, and no user interaction, can upload files of dangerous types, with high impact to confidentiality, integrity and availability.

Official description · CVE.org

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

Breakdown
26.3 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 14 Apr 2023. No public exploit code or confirmed exploitation is recorded.

See the family tree

7 related vulnerabilities in the same code over 16 months. The latest fix listed for froxlor/froxlor is 2.0.20.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2022-3017Cross-Site Request Forgery (CSRF) in froxlor/froxlor28 Aug 2022
  2. same family
    CVE-2022-3721Code Injection in froxlor/froxlor4 Nov 2022
  3. Next fix in the same packageHigh

    Why these are linked:

    • Fixed one release later0.10.38.2 → 0.10.39 (froxlor/froxlor)
    • Same code patched: index.php (machine-matched)commit 1182453commit 3f10a4a
    • Similar weakness in the same product (machine-matched)same product + CWE + description similarity
    CVE-2022-3869Code Injection in froxlor/froxlor5 Nov 2022
  4. same family
    CVE-2023-0316Path Traversal: '\..\filename' in froxlor/froxlor16 Jan 2023
  5. relatedMedium

    Why these are linked:

    This CVECVE-2023-2034Unrestricted Upload of File with Dangerous Type in…14 Apr 2023
  6. relatedMedium

    Why these are linked:

    CVE-2023-4304Business Logic Errors in froxlor/froxlor11 Aug 2023
  7. same family
    CVE-2023-50256Froxlor username/surname AND company field Bypass3 Jan 2024

Fixes in froxlor/froxlorPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.0.11CVE-2023-087717 Feb 2023
  2. 2.0.11CVE-2023-103325 Feb 2023
  3. 2.0.13CVE-2023-130710 Mar 2023
  4. 2.0.14CVE-2023-203414 Apr 2023
  5. 2.0.16CVE-2023-266612 May 2023
  6. 2.0.20CVE-2023-31729 Jun 2023
  7. 2.0.20CVE-2023-31739 Jun 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: froxlor/froxlor.

Packagistfroxlor/froxlorGHSA-qwvp-g9j7-28f6

Upgrade to 2.0.14 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-0315).

Set the version to 2.0.14 or later in your composer.json.

The first fix for CVE-2023-2034.

Affected versions

If you runUpgrade to
All versions before 2.0.142.0.14

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

Other 2

huntr.dev/bounties/aba6beaa-570e-4523-8128-da4d8e374ef6github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6
↑ ↓ chooseEnter openEsc close