CVE-2026-41236

Summary

Summary Froxlor 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to ~/.ssh/authorizedkeys under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace ~/.ssh/authorizedkeys with a symlink to /root/.ssh/authorizedkeys. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Details The customer-facing SSH key workflow accepts an FTP user selection and an arbitrary public key from the authenticated session and forwards them into SshKeys::add(): On the server side, the add handler stores the public key and schedules an NSS rebuild as long as the customer has shell capability enabled at the customer level: Later, a root-owned cron path enters SshKeys::generateFiles() and derives the target path by simple string concatenation: The helper used here only normalizes the path string and does not resolve or reject symlinks: The root-owned sync code then appends attacker-controlled SSH key material to the derived path: Because Froxlor also grants the customer ownership of the home directory tree during account provisioning, the attacker can place a symbolic link at ~/.ssh/authorizedkeys before the privileged synchronization step runs. PoC An attacker needs an authenticated customer account with shell-enabled home-directory control. That prerequisite may exist by normal configuration, or it may be obtained first through the separate FTP shell-assignment authorization bypass described in the companion report. Relevant runtime prerequisites: the attacker controls a customer-owned home directory on the target host the attacking customer has shellallowed=1 the attacker can submit SSH keys through the Froxlor panel Froxlor's master cron runs with the intended root privileges Complete PoC flow: Obtain shell access as the customer-owned account and prepare a symlink in the home directory: From an authenticated Froxlor customer session, submit a new SSH public key for the relevant FTP user: Wait for Froxlor's master cron to process the queued REBUILDNSSUSERS task. Use the corresponding private key to authenticate as root: Result: the root-owned cron task follows the symlinked authorizedkeys path the submitted public key is appended to /root/.ssh/authorizedkeys SSH access as root succeeds with the attacker's key pair Impact This is a direct customer-to-root privilege escalation on the managed host. A successful attacker can obtain full operating-system control, read or modify all hosted customer data, persist at the highest privilege level, and tamper with every service administered by the server.

Impact

Affected versions

Security releases

Remediation advice