Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.
The input validation code uses a comparison operator (==) instead of an assignment operator (=), which completely disables email format checking for all email-type fields. An authenticated administrator can save any arbitrary string containing a pipe character (|) in the panel.adminmail setting, which is explicitly whitelisted. This value is then directly injected into a shell command executed by a cron task with root privileges, resulting in full command injection leading to RCE.
An attacker with administrator panel privileges can execute arbitrary system commands with root privileges on the server, leading to complete system compromise, including violation of confidentiality, integrity, and availability of data.
Froxlor should be updated to version 2.3.4, in which the vulnerability has been fixed. The patch is available in the official project repository and in release 2.3.4 on GitHub.
Froxlor in all versions before 2.3.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HFroxlor
APPFroxlor< 2.3.4
Related vulnerabilities
Froxlor: RCE przez path traversal w parametrze def_language
Froxlor: wstrzyknięcie kodu PHP przez nieskonfigurowany parametr MySQL
Nieprawidłowe rozwiązywanie dowiązań symbolicznych w Froxlor (path traversal via symlink)
Brak ograniczeń prób uwierzytelnienia w Froxlor (brute-force)
Obejście uwierzytelnienia w Froxlor poprzez Primary Weakness