CVE-2026-109961 in Froxlor
Summary
by MITRE • 10/13/2026
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Froxlor versions prior to 2.3.14 represents a critical security flaw rooted in improper input validation within the application's API layer. Specifically, the Ftps.add endpoint accepts an additional_members parameter that is intended to assign users to supplementary groups. However, this parameter fails to sanitize or validate newline characters before processing them for system-level operations. This lack of sanitization creates a pathway for attackers who have obtained valid authentication credentials as customers to manipulate underlying operating system configuration files. The core technical flaw lies in the direct concatenation of user-supplied input into shell commands or file write operations without escaping special characters, which is a classic example of command injection and path traversal vulnerabilities often categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-20 Improper Input Validation.
The operational impact of this vulnerability extends beyond simple data corruption, as it facilitates local privilege escalation through the manipulation of system authentication databases. When a malicious actor injects newline characters into the additional_members parameter, they can effectively break out of the intended single-line format expected by the REBUILD_NSSUSERS cron job. This cron job is responsible for synchronizing user and group information from various sources into /var/lib/extrausers/group, a file used to manage local groups on systems employing NSS (Name Service Switch). By injecting crafted input containing newlines, an attacker can append arbitrary lines to this root-owned configuration file. These injected lines typically define new group memberships that associate the attacker's low-privilege user account with high-privilege system groups such as sudoers or wheel.
This mechanism allows for a significant escalation of privileges from a standard customer account to one with administrative capabilities on the host server. Once the REBUILD_NSSUSERS cron job executes, it writes these unsanitized entries into /var/lib/extrausers/group without verifying their legitimacy or origin. Consequently, the attacker gains unauthorized access to sensitive system resources and can execute commands with elevated privileges, effectively compromising the integrity of the entire hosting environment. This scenario aligns closely with MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to move laterally or escalate privileges within a networked environment. The exploitation does not require remote code execution in the traditional sense but rather abuses trusted system processes and configuration management tools to achieve persistence and control.
Mitigation strategies for this vulnerability must focus on both immediate remediation and long-term architectural improvements. The primary defense is upgrading Froxlor to version 2.3.14 or later, where developers have implemented proper input validation and sanitization routines for the additional_members parameter. In addition to software updates, system administrators should enforce strict least-privilege principles by ensuring that cron jobs running as root do not process untrusted user data directly. Implementing application-level controls such as allowlisting valid group names or using structured data formats like JSON with schema validation can prevent newline injection attacks. Furthermore, monitoring /var/lib/extrausers/group for unexpected changes and auditing the execution of REBUILD_NSSUSERS can help detect exploitation attempts in real-time. Regular security assessments and code reviews focusing on input handling are essential to maintain a robust defense against similar injection-based vulnerabilities.