Froxlor API Information Disclosure Vulnerability

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php have an information disclosure flaw: they retrieve full database rows and return them without removing password and data_2fa fields.

An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts.

• Password hashes can be cracked offline.
• TOTP seeds can generate valid second-factor codes until two-factor authentication is reset.
• Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors.

This issue is fixed in version 2.3.8.