Froxlor 2.3.8 Security Release: CSRF, SSRF, and Data Validation Fixes

Vulnerability Overview Vulnerability Name: froxlor security release 2.3.8 Release Date: Jun 9 Vulnerability Description: This release includes multiple security fixes covering DNS LE tests, MySQL test cleanup, CSRF token validation, redirect URL validation, IP address validation, special character escaping, record label and type safety, API response data sanitization, and data export path security. Scope of Impact Affected Versions: 1.15.2 to 1.16.0 Affected Components: - DNS LE tests - MySQL tests - CSRF token validation - Redirect URL validation - IP address validation - Special character escaping - Record labels and types - API response data - Data export paths Remediation Fixes: - Improved DNS LE test and MySQL test cleanup (by @hknkt in #1409) - Upgraded Axios from 1.15.2 to 1.16.0 (by @dependabot[bot] in #1410) - Added checks for existing files when specified as domain-path (by @hknkt in #1411) - Added CSRF token validation in ajax-actions - Enhanced redirect URL validation for (sub)domains - Validated numeric values for ipaddress-id - Escaped allowed special characters in the frontend - Secured record labels and types in the dns-editor - Sanitized sensitive data from API responses - Secured user-provided data export paths POC Code or Exploit Code No specific POC code or exploit code was included in the page. Additional Information New Contributor: @hknkt made their first contribution (in #1409) Full Changelog: 2.3.7...2.3.8 Assets: - froxlor-2.3.8.tar.gz (4.21 MB, Jun 9) - froxlor-2.3.8.zip (5.59 MB, Jun 9) - Source code (zip) (Jun 9) - Source code (tar.gz) (Jun 9) Summary This release primarily fixes multiple security vulnerabilities across various components and features, ensuring the system's security when handling DNS, MySQL, CSRF, redirects, IP addresses, special characters, record labels, API responses, and data exports. Users are advised to upgrade to version 2.3.8 as soon as possible to resolve these security issues.

Goal Reached Thanks to every supporter — we hit 100%!

Froxlor 2.3.8 Security Release: CSRF, SSRF, and Data Validation Fixes

More from this source