CVE-2026-55593

## Summary The Froxlor AJAX endpoint (`lib/ajax.php`) is missing Cross-Site Request Forgery (CSRF) protection. While the main application (`lib/init.php`) enforces CSRF token validation on all state-changing HTTP requests (POST/PUT/PATCH/DELETE), the standalone `lib/ajax.php` endpoint bypasses this mechanism entirely, validating only the user's session. An attacker can craft a malicious webpage that, when visited by an authenticated Froxlor administrator, silently modifies API key properties (e.g., adding the attacker's IP to the `allowed_from` whitelist or extending the `valid_until` expiration). --- ## Affected Component - **File:** `lib/ajax.php` — the AJAX endpoint entry point (bypasses `lib/init.php`) - **File:** `lib/Froxlor/Ajax/Ajax.php:66-92` — `Ajax::handle()` (no CSRF check before routing) - **File:** `lib/Froxlor/Ajax/Ajax.php:257-315` — `Ajax::editApiKey()` (writes to database without CSRF check) - **Version:** Froxlor 2.3.7 (likely all prior 2.x versions) --- ## Complete Call Chain: Entry Point → Vulnerable Code ### Step 1: Entry Point — `lib/ajax.php` (standalone bootstrap, bypasses `lib/init.php`) ```php // lib/ajax.php:26-47 namespace Froxlor; use Froxlor\Ajax\Ajax; require_once dirname(__DIR__) . '/vendor/autoload.php'; require_once dirname(__DIR__) . '/lib/userdata.inc.php'; require_once dirname(__DIR__) . '/lib/functions.php'; require_once dirname(__DIR__) . '/lib/tables.inc.php'; // CRITICAL: This file does NOT include lib/init.php // Therefore: NO CSRF token is checked before processing the request echo (new Ajax)->handle(); ``` **Contrast with normal flow:** All admin/customer pages (e.g., `admin_customers.php`, `customer_domains.php`) do: ```php const AREA = 'admin'; require __DIR__ . '/lib/init.php'; // <-- This enforces CSRF at lines 363-369 ``` ### Step 2: Ajax Constructor — Session Created, No CSRF Check ```php // lib/Froxlor/Ajax/Ajax.php:54-61 public function __construct() { $this->action = Request::any('action'); //