Описание
Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron
Summary
DataDump.add() constructs the export destination path from user-supplied input without passing the $fixed_homedir parameter to FileDir::makeCorrectDir(), bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes chown -R on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system.
Details
The vulnerability is an incomplete patch. After CVE-2023-6069, symlink validation was added to FileDir::makeCorrectDir() via a $fixed_homedir parameter. When provided, it walks each path component checking for symlinks that escape the customer's home directory (lines 134-157 of lib/Froxlor/FileDir.php).
Every customer-facing API command that builds a path from user input passes this parameter:
But DataDump.add() was missed:
The path flows unvalidated into a cron task (lib/Froxlor/Api/Commands/DataDump.php:133):
When ExportCron::handle() runs as root, it executes at lib/Froxlor/Cron/System/ExportCron.php:232:
The chown -R command follows symlinks in its target argument. If $data['destdir'] resolves through a symlink to an arbitrary directory, the attacker's UID/GID is applied recursively to that directory and all its contents.
The Validate::validate() call on line 86 uses an empty pattern, which falls back to /^[^\r\n\t\f\0]*$/D — this only strips control characters and does not prevent symlink names. makeSecurePath() strips shell metacharacters and .. traversal but does not check for symlinks.
PoC
Prerequisites:
system.exportenabled= 1 (admin setting)- Customer account with API key and FTP/SSH access
Impact
- Horizontal privilege escalation: A customer can take ownership of any other customer's web files, databases exports, and email data on the same server.
- Vertical privilege escalation: By targeting system directories (e.g.,
/etc), the customer can gain read/write access to/etc/passwdand/etc/shadow, enabling creation of a root account or password modification. - Data breach: Full read access to all files in the targeted directory tree, including configuration files with database credentials, application secrets, and user data.
- Service disruption: Changing ownership of system directories can break system services.
The attack requires only a single API call and a symlink. The impact is delayed until the next cron run (typically hourly), making it harder to attribute.
Recommended Fix
Pass $customer['documentroot'] as the $fixed_homedir parameter in DataDump.add(), consistent with every other API command:
Additionally, the ExportCron should use chown -h (no-dereference) or validate the destination path is not a symlink before executing chown -R:
Пакеты
froxlor/froxlor
< 2.3.6
2.3.6
Связанные уязвимости
Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from user-supplied input without passing the `$fixed_homedir` parameter to `FileDir::makeCorrectDir()`, bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes `chown -R` on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system. Version 2.3.6 contains an updated fix.
Froxlor is open source server administration software. Prior to versio ...