CVE-2026-100717 in Froxlor
Summary
by MITRE • 09/26/2026
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2. An authenticated low-privilege customer with subdomain-create rights (no admin or change_serversettings privilege required) can supply a subdomain redirect URL that carries a CR/LF payload in the userinfo portion (e.g. http://user%0areturn 200 "pwned";%[email protected]/). The value passes validation, survives IDNA encoding, and is written verbatim into the generated nginx or Apache vhost configuration, allowing the attacker to break out of the emitted directive and inject arbitrary web-server configuration lines. froxlor regenerates and reloads the web-server configuration as root, so the injected directives take effect server-wide and can hijack responses or read local files. The issue is fixed in version 2.3.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Froxlor versions up to 2.3.10 represents a critical configuration injection flaw stemming from an incomplete remediation of a previous security advisory, specifically GHSA-c3p2. Froxlor is widely deployed as a server administration panel that manages web hosting environments by generating configuration files for underlying web servers such as Nginx or Apache. The core technical deficiency lies within the Validate::validateUrl function, which was intended to sanitize user-supplied URLs used in subdomain redirect configurations. While previous fixes addressed carriage return and line feed characters in the path, query, and fragment components of a URL by rejecting them during parsing via parse_url, this validation logic failed to inspect the userinfo component, commonly known as the authority section containing credentials (user:pass@). This oversight allows an attacker to bypass input sanitization mechanisms by embedding malicious control characters within the username or password portion of a URL.
An authenticated low-privilege user possessing subdomain creation rights can exploit this flaw without requiring administrative privileges or access to change server settings, significantly lowering the barrier for exploitation. By constructing a specially crafted redirect URL that includes carriage return and line feed sequences encoded in percent-encoded format within the userinfo segment, such as http://user%0areturn 200 "pwned";%[email protected]/, the attacker ensures these characters survive IDNA encoding processes and pass through the flawed validation routine. Because the validation logic does not strip or reject control characters from this specific component of the URL structure, the malicious payload is treated as valid input by the application layer.
The operational impact arises when Froxlor writes this unsanitized data directly into the generated configuration files for Nginx or Apache. Since these directives are written verbatim without further escaping, the embedded newline characters allow the attacker to break out of the intended directive context and inject arbitrary web server configuration lines. This capability effectively grants the low-privilege user the ability to modify global server settings through a misconfiguration in the application's output generation process. The severity is amplified by the operational workflow of Froxlor, which automatically regenerates and reloads the web server configuration with root privileges after such changes are applied. Consequently, any injected directives take effect immediately across the entire server environment.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves injecting code-like commands into a configuration file that is interpreted by a privileged process. Furthermore, from an ATT&CK perspective, this technique corresponds to T1505 Server Software Component: Web Shell or more broadly T1222 File and Directory Permissions Modification if the injected directives alter access controls, but primarily it fits within lateral movement or privilege escalation vectors where configuration files are manipulated to gain unauthorized control. The ability to hijack HTTP responses allows for phishing attacks, session hijacking, or serving malicious content under trusted domains, while reading local files can lead to sensitive data exposure including database credentials and application secrets stored on the server filesystem.
The recommended mitigation is straightforward: administrators must upgrade Froxlor to version 2.3.12 or later where this validation gap has been closed by extending input sanitization to include all components of a URL, not just path and query strings. Until an upgrade can be performed, temporary mitigations may involve restricting subdomain creation privileges to trusted users only or implementing web application firewall rules that detect and block HTTP response splitting attempts involving carriage return and line feed characters in URL parameters. However, given the root-level execution context of configuration reloads, upgrading remains the most effective remediation strategy to eliminate this privilege escalation vector entirely.