CVE-2026-100717: froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2. An authenticated low-privilege customer with subdomain-create rights (no admin or changeserversettings privilege required) can supply a subdomain redirect URL that carries a CR/LF payload in the userinfo portion (e.g. http://user%0areturn 200 "pwned";%0a@evil.com/). The value passes validation, survives IDNA encoding, and is written verbatim into the generated nginx or Apache vhost configuration, allowing the attacker to break out of the emitted directive and inject arbitrary web-server configuration lines. froxlor regenerates and reloads the web-server configuration as root, so the injected directives take effect server-wide and can hijack responses or read local files. The issue is fixed in version 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege Froxlor customer can exploit it if they have permission to create subdomains. Administrative privileges and the change_serversettings privilege are not required.
Are standard web-server deployments affected?
The issue affects generated nginx and Apache virtual-host configurations when a vulnerable Froxlor version processes a malicious subdomain redirect URL. The injected configuration is applied when Froxlor regenerates and reloads the web-server configuration as root.
What attacker-controlled value is required?
The attacker must be able to provide a subdomain redirect URL containing CR/LF characters in the URL userinfo portion, before the @ delimiter. Validation checks the path, query, and fragment components but does not inspect userinfo.
What is the remediation?
Upgrade Froxlor to version 2.3.12, which fixes the issue. The provided data does not specify an alternative mitigation for environments that cannot immediately upgrade.
How can administrators assess possible exploitation?
Inspect generated nginx or Apache vhost configuration for unexpected directives or line breaks associated with subdomain redirect URLs, particularly URLs using a userinfo component before an @ sign. Review subdomain redirect values created by low-privilege customer accounts with subdomain-create rights.