CVE-2026-90937 Configuration Injection in Froxlor

Froxlor versions prior to 2.2.5 fail to perform adequate input validation on subdomain redirect URLs within the administrative interface. An authenticated customer can submit a crafted URL containing literal newline characters (\n or \r\n). When the froxlor cron job triggers a configuration rebuild for the web server, these newline characters are written verbatim into the generated vhost configuration files for Nginx or Apache.

This injection allows an attacker to terminate existing configuration lines and introduce entirely new directives into the web server context. This can lead to the hijacking of HTTP responses across other hosted domains, redirection of traffic to malicious destinations, or denial of service through the injection of syntax errors that prevent web server service restarts. Defenders should prioritize updating to version 2.2.5 or later to enforce proper sanitization of redirect parameters.

Attack Chain

1. Attacker authenticates to the froxlor customer panel.
2. Attacker navigates to the subdomain management section.
3. Attacker submits a new or existing subdomain redirect URL containing injected newline characters followed by malicious web server directives (e.g., 'https://site.com\nrewrite ^/ /malicious_path').
4. The input is persisted in the backend database without validation.
5. The server-side cron job executes, invoking the configuration generator script.
6. The script retrieves the malicious input and writes it to the active Nginx or Apache vhost configuration file.
7. The system reloads the web server configuration to apply changes.
8. Web server processes the injected directives, leading to hijacking or service disruption.

Impact

Successful exploitation allows an authenticated user to perform service-wide configuration corruption. This enables attackers to hijack HTTP responses for unrelated domains hosted on the same infrastructure, bypass security controls, or cause a denial of service for the entire web server instance.

Recommendation

• Upgrade Froxlor to version 2.2.5 or later immediately.
• Review web server configuration files for unexpected directives, particularly those following subdomain definitions.
• Audit logs for customer panel activity specifically looking for URL inputs containing newline characters.