Description

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-13T11:17:00.947Z",
  "pubdate": "2026-09-13T11:17:00.947Z",
  "executiveSummary": "Froxlor versions prior to 2.3.12 contain a critical vulnerability in the SshKeys::add() method, characterized by improper input validation of multi-line SSH public keys.\nThis flaw allows authenticated users to perform an injection attack against the server's authorized_keys configuration file.\nBy manipulating input strings, an attacker can bypass standard security controls to append unauthorized entries or malicious SSH option directives into the authorized_keys file.\nThe primary risk implications include persistent unauthorized access, privilege escalation, and the ability to circumvent SSH access revocation or key management workflows.\nBecause the injected entries can contain directives that persist even after the intended key management operations, this vulnerability poses a severe threat to account integrity.\nSuccessful exploitation requires authenticated access to the Froxlor interface but allows for post-exploitation persistence that operates outside the intended administrative controls.",
  "technicalDetails": "The vulnerability resides in the SshKeys::add() function within the Froxlor application, which fails to adequately sanitize multi-line input for SSH public key uploads.\nThe root cause is an insufficient validation mechanism that does not treat the input string as a single, restricted SSH key entity, thereby permitting the inclusion of newline characters (e.g., \\n) and subsequent malicious directives.\nThe attack flow begins when an attacker provides a crafted string to the affected endpoint. By injecting newline characters, the attacker terminates the current line and initiates a new entry within the ~/.ssh/authorized_keys file associated with the target system account.\nBecause the file write operation does not adequately escape the user-supplied input, the underlying operating system process appends the arbitrary text to the file.\nAttackers can leverage this to inject SSH options such as 'command=', 'restrict', or additional authorized keys that provide persistent shell access.\nA significant feature of this vulnerability is the persistence mechanism: by injecting specific configuration directives or secondary public keys, an attacker ensures that access is maintained even if the original, legitimate key is deleted or revoked through the Froxlor interface.\nThis is possible because the injected content remains in the authorized_keys file, effectively poisoning the file structure in a way that the application's internal key-tracking logic cannot identify or remove.\nThe vulnerability is present in versions of Froxlor prior to 2.3.12. Exploitation is constrained to authenticated users with permissions to manage SSH keys, but it significantly elevates the threat level by allowing those users to achieve persistence beyond their assigned scope.\nThe resulting impact is an unauthorized persistent backdoor, where the integrity of the SSH authentication process is compromised, allowing for potential lateral movement or long-term system control that bypasses standard administrative lifecycle management for SSH access."
}