LoginSign Up
← Back to all sparks
F

Froxlor

DEVOPS
Velocity0.0

Server administration and hosting control panel

froxlor.org ↗

Seven consecutive security releases as froxlor works through an input-validation audit.

hosting-control-panelsecurityinput-validationdnsphpaccess-control
◆Current state
Every froxlor release since February has been titled a security release, and the pattern inside them is consistent: batches of validation fixes across the API and frontend rather than responses to single disclosures. The work covers DNS record content validation across LOC, RP, SSHFP, TLSA, NAPTR and TXT types, path traversal and symlink resolution in data export and authorized_keys handling, ownership checks in email and domain operations, CSRF tokens on AJAX actions, and requiring the current password before generating an API key. The June sequence — 2.3.8, then 2.3.9 and 2.3.10 the same day — shows a regression being chased immediately after a fix.
◆Where it's heading
This reads as a systematic audit being worked through in order rather than incident response. The fixes group by class — first DNS record content, then path and symlink containment, then ownership and authorisation checks, then CSRF and response filtering — which is what a methodical pass over a hosting control panel's attack surface looks like. A control panel is an unusually high-value target since it holds root-adjacent capability over customer domains, mail and databases, so the concentration on ownership validation and path containment is well aimed. Feature work is essentially absent; the non-security content is translations and dependency bumps.
◆Prediction
Expect the security-release cadence to continue until the audit is exhausted, with the remaining validation surface — likely the config-service and task-generation paths — as the next area. The same-day 2.3.9 and 2.3.10 sequence suggests the team will keep shipping fast follow-ups rather than batching regressions into the next monthly release.

◆Recent moves

  1. 2mo ago

    froxlor security release 2.3.10

    Published the same day as 2.3.9 and 2.3.8, with no release notes at all beyond a changelog link. The timing places it as the tail of the 2.3.8 regression chase rather than independent work.

    View source ↗
  2. 2mo ago

    2.3.9 reverts an HTTP-to-HTTPS redirect regression from 2.3.8

    A single fix for redirect creation broken hours earlier by the 2.3.8 security batch. The speed of the follow-up is the notable part — a broken HTTPS redirect on a hosting panel affects every customer domain configured through it.

    View source ↗
  3. 2mo ago

    2.3.8 adds CSRF tokens to AJAX actions and filters API responses

    Adds CSRF token validation to AJAX actions, tightens redirect URL validation for domains and subdomains, escapes DNS TXT content in the frontend, and strips sensitive data from API responses. The response-filtering and CSRF work moves the audit from input validation into output and session handling.

    View source ↗
  4. 2mo ago

    2.3.7 contains SSH keys and data export to customer directories

    The largest batch in the window: authorized_keys files constrained to the customer document root, symlinks resolved and validated in file path handling, shells verified on FTP account creation, MySQL server values checked against the customer's allowed list, and API key generation now requiring the current password. These are containment fixes — each one stops a customer reaching outside their own boundary.

    View source ↗
  5. 4mo ago

    2.3.6 closes path traversal and domain ownership gaps

    Validates the def_language parameter against existing language files to prevent path traversal, fixes quote escaping when generating userdata.inc.php, adds symlink validation to data export, and repairs domain ownership checks in EmailSender.add plus an unvalidated admin ID in Domains.add. The ownership bugs are the serious ones, since they cross tenant boundaries.

    View source ↗
  6. 5mo ago

    2.3.5 updates the default TLS cipher list and validates DNS records

    Adopts Mozilla's recommended cipher list as the default and adds specification-conformant validation for LOC, RP, SSHFP and TLSA DNS record content. The cipher change quietly alters TLS behaviour for every vhost froxlor generates, which is worth knowing before upgrading.

    View source ↗