Description

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authenticated, non-superadmin admin holding the delegated customers_see_all flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data_2fa but not dkim_privkey. The issue is fixed in 2.3.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-26T14:16:56.580Z",
  "pubdate": "2026-09-26T14:16:56.580Z",
  "executiveSummary": "Froxlor versions through 2.3.10 contain an information disclosure vulnerability within the API framework. The vulnerability stems from an insecure implementation of database retrieval functions that fail to redact sensitive cryptographic material from result sets. Specifically, API calls related to domain and subdomain management perform wildcard SELECT queries on the panel_domains table, returning the raw data, including dkim_privkey fields, to the caller.\nThe vulnerability allows an authenticated administrative user, who possesses the delegated 'customers_see_all' flag but lacks superadmin status, to access the private DKIM keys of domains belonging to other tenants. This exposure facilitates the unauthorized signing of emails, which will subsequently pass DKIM verification and DMARC alignment checks, posing a significant risk to email integrity and domain reputation. The issue represents an incomplete remediation of a previous security fix that addressed password and 2FA data exposure but failed to account for DKIM keys. Exploitation requires authenticated access to the API and the relevant administrative privileges.",
  "technicalDetails": "The vulnerability is located in the Froxlor API components responsible for managing domain records. Specifically, the functions Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() utilize insecure database query patterns. These functions execute a 'SELECT *' operation against the 'panel_domains' table without applying any output filtering or blacklisting to sensitive database columns.\nThe root cause is an inadequate filtering mechanism within the API's response handling logic. While previous updates attempted to strip fields like 'password' and 'data_2fa' from outgoing API responses, the 'dkim_privkey' column was inadvertently omitted from this exclusion list. Consequently, when an API call is made, the application serializes the entire database row, including the private DKIM signing key, and transmits it back to the client.\nExploitation is feasible for any authenticated administrative user who has been granted the 'customers_see_all' privilege. By invoking the vulnerable API methods, the attacker can enumerate all domains managed within the panel and retrieve the associated cryptographic private keys. The attack flow is straightforward: 1) The attacker authenticates to the Froxlor API using their legitimate credentials. 2) The attacker issues a call to 'Domains.listing' or 'SubDomains.listing'. 3) The server returns a JSON response containing the full database records for all visible domains. 4) The attacker parses the returned data to extract the 'dkim_privkey' values for targeted domains.\nOnce the private keys are compromised, the attacker can perform unauthorized email signing. Because these keys are valid for the specific domain, the attacker can craft malicious emails that appear to originate from the victim domain, successfully bypassing DKIM verification and DMARC alignment policies. This provides a platform for sophisticated phishing, brand impersonation, and spoofing attacks. The vulnerability affects all Froxlor versions up to and including 2.3.10 and remains exploitable until the specific application logic is updated to explicitly exclude the 'dkim_privkey' field from the API serialization pipeline. The flaw is addressed in version 2.3.12."
}