Authenticated Sender Alias Enumeration in Froxlor

Executive Summary

Froxlor before 2.3.7 has an information disclosure vulnerability in customer_email.php. Authenticated attackers can exploit it to enumerate global sender alias IDs and read other customers' allowed sender values by submitting arbitrary senderid parameters in delete confirmation requests.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Froxlor versions before 2.3.7. Inspect customer_email.php for improper sender alias ID scoping. Test by submitting arbitrary senderid parameters in delete confirmation requests to see if other customers' allowed sender values are exposed.

Useful 0 Not Useful 0

Impact Analysis

If you are a Froxlor user running versions before 2.3.7, an authenticated attacker could access your allowed sender aliases or those of other customers. This could lead to unauthorized exposure of email configuration details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive customer data to unauthorized parties. Compliance may require immediate patching to prevent unauthorized access to personal or confidential information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Froxlor to version 2.3.7 or later. Ensure sender alias lookups are scoped to the current customer and mailbox in customer_email.php. Disable the mail.enable_allow_sender setting if not required.

Useful 0 Not Useful 0