DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55593: CVE-2026-55593: Persistent Administrative Hijacking via Cross-Site Request Forgery in Froxlor Ajax Router

#security #cve #cybersecurity

CVE-2026-55593: Persistent Administrative Hijacking via Cross-Site Request Forgery in Froxlor Ajax Router

Vulnerability ID: CVE-2026-55593
CVSS Score: 6.5
Published: 2026-08-18

Froxlor prior to version 2.3.8 contains a high-severity architectural flaw where the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php. Unauthenticated remote attackers can leverage Cross-Site Request Forgery (CSRF) to induce authenticated administrators to submit forged requests that modify API key whitelists and expiration dates, potentially yielding persistent, out-of-band administrative control.

TL;DR

An architectural flaw in Froxlor's standalone AJAX handler allows remote attackers to perform Cross-Site Request Forgery (CSRF) attacks to silently alter administrative API key parameters and gain persistent, unauthorized server access.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-352 (Cross-Site Request Forgery)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.5 Medium
  • EPSS Score: Not available
  • Impact: High Integrity Modification (I:H)
  • Exploit Status: Proof of Concept / Technical Analysis
  • CISA KEV Status: Not Listed

Affected Systems

  • Froxlor Server Administration Panel
  • Froxlor: < 2.3.8 (Fixed in: 2.3.8)

Code Analysis

Commit: 5f540fe

add csrf check and rate limiter to ajax handle

Mitigation Strategies

  • Upgrade Froxlor to version 2.3.8 or higher.
  • Configure modern SameSite cookie flags (Lax or Strict) on session identifiers.
  • Enforce network segmentation limiting access to administrative endpoints.

Remediation Steps:

  1. Retrieve the latest repository updates or download Froxlor v2.3.8 directly from the official source.
  2. Apply the database and file system migrations to update the underlying dependencies and configurations.
  3. Verify that the 'csrf_token' field is properly generated within user sessions.
  4. Inspect browser cookie settings to confirm SameSite cookies are active.

References

Read the full report for CVE-2026-55593 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)