Froxlor - CraftedSignal Threat Feed

Froxlor BIND Zone File Injection Vulnerability

hello@craftedsignal.io — Wed, 03 Jul 2024 12:00:00 +0000

Froxlor, a server management panel, is vulnerable to a BIND zone file injection vulnerability (CVE-2026-30932) affecting versions 2.3.4 and earlier. This vulnerability exists within the DomainZones.add API endpoint, accessible to customers with DNS enabled. Due to insufficient validation of the content field for specific DNS record types (LOC, RP, SSHFP, TLSA), attackers can inject arbitrary BIND zone file directives. This injection occurs because the content field is not properly sanitized, as highlighted by a TODO comment in the source code. Successful exploitation can lead to unauthorized file access, DNS service disruptions, and manipulation of zone data. This vulnerability poses a significant risk to Froxlor users as it allows malicious actors to compromise the integrity and availability of DNS services.

Attack Chain

Attacker gains access to a Froxlor customer account with DNS management enabled.
The attacker crafts a malicious API request to the DomainZones.add endpoint.
The API request includes a DNS record type (LOC, RP, SSHFP, TLSA) and a content field containing injected BIND directives, such as $INCLUDE /etc/passwd.
The Froxlor application writes the unsanitized content directly into the BIND zone file via DnsEntry::__toString().
The DNS rebuild cron job runs, processing the modified zone file.
BIND attempts to parse the injected directives, such as including /etc/passwd as zone data.
The attacker uses the DomainZones.get API or web UI to view the zone file and extract sensitive information or confirms service disruption.
Successful exploitation leads to information disclosure, DNS service disruption, or zone data manipulation.

Impact

Successful exploitation of this vulnerability can have significant consequences. Information disclosure allows attackers to read world-readable files on the server, potentially exposing sensitive data. DNS service disruption can occur if the injected content causes BIND to fail to load the zone, leading to downtime for affected domains. Furthermore, attackers can manipulate zone data by injecting arbitrary DNS records, potentially redirecting traffic or causing other malicious activities. The vulnerability affects Froxlor versions 2.3.4 and earlier.

Recommendation

Apply the patch or upgrade to a version of Froxlor greater than 2.3.4 to remediate CVE-2026-30932, which addresses the input validation issue.
Deploy the Sigma rule "Detect Froxlor BIND Zone File Injection Attempts" to identify suspicious API requests targeting the DomainZones.add endpoint (rules).
Monitor web server logs for POST requests to /api.php with command: DomainZones.add and suspicious characters or BIND directives in the params field to detect exploitation attempts (webserver).

Froxlor API Local File Inclusion leads to Remote Code Execution

hello@craftedsignal.io — Fri, 26 Jan 2024 18:22:00 +0000

Froxlor, a server management panel, is vulnerable to a critical remote code execution (RCE) vulnerability due to insufficient validation of the def_language parameter in its API. An authenticated customer can exploit this vulnerability by injecting a path traversal sequence into the def_language setting via the Customers.update API endpoint. The injected path traversal allows an attacker to load and execute arbitrary PHP code outside of the intended language file directory. This vulnerability affects Froxlor versions 2.3.5 and earlier. Successful exploitation allows the attacker to execute arbitrary PHP code as the web server user, potentially leading to full server compromise. This issue stems from inconsistent validation between the web UI and the API, where the API lacks proper sanitization against path traversal.

Attack Chain

Attacker gains valid customer credentials for a Froxlor panel.
Attacker uploads a malicious PHP file (e.g., evil.lng.php) containing code to execute arbitrary commands, to their web directory via FTP.
Attacker crafts an API request to the Customers.update endpoint, setting the def_language parameter to a path traversal sequence pointing to the malicious PHP file (e.g., ../../../../../var/customers/webs/customer1/evil).
The Froxlor API stores the tainted def_language value in the database without proper validation.
Attacker triggers the vulnerability by making another API request (e.g., Customers.get).
The ApiCommand::initLang() function loads the malicious def_language value from the database.
Language::setLanguage() and Language::loadLanguage() functions are called, which construct a file path using the attacker-controlled value and attempts to load a PHP file.
The require statement within Language::loadLanguage() executes the malicious PHP code, granting the attacker RCE as the web server user (e.g., www-data).

Impact

Successful exploitation allows an authenticated customer to execute arbitrary PHP code as the web server user. This can lead to: full server compromise by obtaining database credentials and accessing sensitive information, lateral movement to other customer environments within the shared hosting panel, persistent backdoors by modifying core system files or cron jobs, and data exfiltration, allowing the attacker to steal all hosted databases and email content. The vulnerable API is enabled by default.

Recommendation

Apply the vendor-supplied patch described in the source URL to remediate the vulnerable API endpoint (https://github.com/advisories/GHSA-w59f-67xm-rxx7).
Deploy the Sigma rule Froxlor_Suspicious_DefLanguage_Update to detect attempts to exploit the vulnerable API endpoint.
Enable web server logging to facilitate detection of API requests with malicious def_language parameters.
Monitor the file system for creation of .lng.php files in customer web directories as part of the attack chain, using the Sigma rule Froxlor_Malicious_Lng_File_Creation.

Froxlor DataDump.add() Incomplete Symlink Validation Allows Arbitrary Directory Ownership Takeover

hello@craftedsignal.io — Mon, 08 Jan 2024 12:00:00 +0000

Froxlor, a server management panel, is vulnerable to an arbitrary directory ownership takeover in versions prior to 2.3.6. The vulnerability stems from an incomplete fix for CVE-2023-6069 related to symlink validation. Specifically, the DataDump.add() function lacks the $fixed_homedir parameter in its call to FileDir::makeCorrectDir(), which is present in other customer-facing API commands. This oversight allows a malicious customer to create a symlink within their web directory that points to an arbitrary directory on the system. When the ExportCron task runs as root, it executes chown -R on the resolved symlink target, effectively changing the ownership of the target directory and its contents to the attacker's user ID and group ID. This can lead to horizontal and vertical privilege escalation, data breaches, and service disruptions. The vulnerability can be triggered via a single API call, and the impact is delayed until the next cron run (typically hourly).

Attack Chain

Attacker creates a symlink within their web directory (accessible via FTP/SSH) pointing to a target directory (e.g., /var/customers/webs/victim_customer or /etc). For example: ln -s /var/customers/webs/victim_customer /var/customers/webs/attacker_customer/steal.
Attacker crafts an API request to DataDump.add() specifying the path to the created symlink (e.g., "path":"steal").
The DataDump.add() function, located in DataDump.php, calls FileDir::makeCorrectDir() without the $fixed_homedir parameter, bypassing symlink validation.
The API call schedules a CREATE_CUSTOMER_DATADUMP task via Cronjob::inserttask(), including the unvalidated path as destdir in the task data.
The ExportCron::handle() function executes periodically as root, processing the scheduled data dump tasks.
The ExportCron executes a series of commands including mkdir -p, tar cfz, and chown -R with the attacker-controlled destdir path.
The chown -R command, executed via FileDir::safe_exec(), resolves the symlink and recursively changes the ownership of the target directory to the attacker's UID and GID.
The attacker now owns the target directory and can modify files, escalate privileges, or disrupt services.

Impact

This vulnerability can have severe consequences: A malicious customer can take ownership of other customer's web files, databases, and email data, leading to data breaches. By targeting system directories like /etc, they can gain root access by modifying system files like /etc/passwd and /etc/shadow. This can lead to full system compromise. The attack requires minimal effort and can be difficult to trace due to the delayed impact. Successful exploitation leads to full read/write access to all files in the targeted directory, as well as potential service disruption.

Recommendation

Apply the patch provided by Froxlor in version 2.3.6, which corrects the call to FileDir::makeCorrectDir() in DataDump.add() to include the $fixed_homedir parameter (see fix in advisory).
Deploy the "Froxlor DataDump API Call with Suspicious Path" Sigma rule to detect API calls to DataDump.add() with potentially malicious paths in web server logs.
Implement the suggested fix in ExportCron.php to check if the destination path is a symlink before executing chown -R (see fix in advisory).
Monitor process creation events for the execution of chown -R by the root user or the user running the Froxlor cron jobs, with a destination path that may indicate a symlink using the "Froxlor Suspicious chown Execution" Sigma rule.

Froxlor PHP Code Injection via Unescaped Single Quotes in userdata.inc.php

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Froxlor versions 2.3.5 and earlier contain a PHP code injection vulnerability in userdata.inc.php due to improper handling of single quotes. An administrator with the change_serversettings permission can inject arbitrary PHP code through the MysqlServer.add or MysqlServer.update API endpoints. The vulnerability exists because the PhpHelper::parseArrayToString() function writes string values into single-quoted PHP string literals without escaping single quotes. Specifically, the privileged_user parameter, which lacks input validation, is written to lib/userdata.inc.php. Since this file is included on every request via Database::getDB(), a successful exploit results in arbitrary PHP code execution as the web server user. This allows attackers to compromise the server, exfiltrate data, move laterally, establish persistent backdoors, or cause denial of service.

Attack Chain

An administrator with change_serversettings permission authenticates to the Froxlor API.
The attacker sends a POST request to api.php with the command MysqlServer.add or MysqlServer.update, injecting PHP code into the privileged_user parameter.
The API endpoint lib/Froxlor/Api/Commands/MysqlServer.php processes the request, calling PhpHelper::parseArrayToPhpFile() through generateNewUserData().
PhpHelper::parseArrayToString() at lib/Froxlor/PhpHelper.php formats the injected code without proper escaping, writing it into the 'user' key within an array.
The array is then written to lib/userdata.inc.php using file_put_contents().
Subsequent HTTP requests to the Froxlor panel trigger Database::getDB() at lib/Froxlor/Database/Database.php.
Database::getDB() includes lib/userdata.inc.php using require, resulting in the execution of the injected PHP code.
The injected code executes commands as the web server user, allowing the attacker to achieve their objectives such as data exfiltration or establishing a persistent backdoor.

Impact

Successful exploitation allows an admin with change_serversettings permissions to achieve arbitrary OS command execution as the web server user. This can lead to full server compromise, allowing attackers to read all hosted customer data, including database credentials and TLS private keys. Attackers can also use the compromised server for lateral movement, accessing MySQL databases and other internal systems. The injected code persists on every request, providing a persistent backdoor. Malformed PHP can also lead to a denial of service condition, disrupting the entire Froxlor panel. The vulnerability affects Froxlor installations up to and including version 2.3.5.

Recommendation

Apply the patch provided in the advisory that escapes single quotes in PhpHelper::parseArrayToString() before interpolating values, specifically by escaping backslashes and then single quotes.
Alternatively, use nowdoc syntax for all string values in PhpHelper::parseArrayToString() as defense-in-depth to completely prevent injection.
Deploy the Sigma rule Detect Froxlor MysqlServer API Abuse to identify potential exploitation attempts by monitoring API requests to the /api.php endpoint.
Enable webserver logging to detect the execution of injected php code, and tune the Detect Froxlor PHP Code Injection in userdata.inc.php Sigma rule.
Restrict and monitor change_serversettings permissions to reduce the attack surface.