7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-75h4-c557-j89r

GHSA-75h4-c557-j89r: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

Summary

DataDump.add() constructs the export destination path from user-supplied input without passing the $fixed_homedir parameter to FileDir::makeCorrectDir(), bypassing the symlink validation that was added to all other customer-facing path operations (likely as the fix for CVE-2023-6069). When the ExportCron runs as root, it executes chown -R on the resolved symlink target, allowing a customer to take ownership of arbitrary directories on the system.

Details

The vulnerability is an incomplete patch. After CVE-2023-6069, symlink validation was added to FileDir::makeCorrectDir() via a $fixed_homedir parameter. When provided, it walks each path component checking for symlinks that escape the customer's home directory (lines 134-157 of lib/Froxlor/FileDir.php).

Every customer-facing API command that builds a path from user input passes this parameter:

// DirProtections.php:87
$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']);

// DirOptions.php:96
$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']);

// Ftps.php:178
$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']);

// SubDomains.php:585
return FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path, $customer['documentroot']);

But DataDump.add() was missed:

// DataDump.php:88 — NO $fixed_homedir parameter
$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path);

The path flows unvalidated into a cron task (lib/Froxlor/Api/Commands/DataDump.php:133):

Cronjob::inserttask(TaskId::CREATE_CUSTOMER_DATADUMP, $task_data);

When ExportCron::handle() runs as root, it executes at lib/Froxlor/Cron/System/ExportCron.php:232:

FileDir::safe_exec('chown -R ' . (int)$data['uid'] . ':' . (int)$data['gid'] . ' ' . escapeshellarg($data['destdir']));

Miggo Vulnerability Database

→

GHSA-75h4-c557-j89r

GHSA-75h4-c557-j89r:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
froxlor/froxlor	composer	< 2.3.6	2.3.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic time-of-check-to-time-of-use (TOCTOU) weakness combined with a symlink following vulnerability. The root cause is an incomplete patch for a previous vulnerability (CVE-2023-6069). The analysis of the patch commit 2987b0e8806ef12b532410050ad76d13d673a87d confirms this.

The exploitation chain starts when a user makes an API call to Froxlor\Api\Commands\DataDump::add. This function fails to properly validate the user-provided path parameter for symlinks because it calls FileDir::makeCorrectDir without the second argument ($fixed_homedir), which is responsible for enforcing this check. This allows an attacker to create a data dump task where the destination path is a symlink to a sensitive directory on the server.

Later, a privileged cron job executes Froxlor\Cron\System\ExportCron::createCustomerExport. This function receives the unvalidated path and executes a chown -R command on it as the root user. The -R flag causes chown to recursively change ownership and, critically, to follow the symlink provided by the attacker. This allows the attacker to gain ownership of the target directory and all its contents, leading to horizontal or vertical privilege escalation.

Vulnerable functions

Froxlor\Api\Commands\DataDump::add

lib/Froxlor/Api/Commands/DataDump.php

The `add` function in the `DataDump` class constructs a path from user-supplied input. The vulnerability lies in the call to `FileDir::makeCorrectDir` which is missing the `$fixed_homedir` parameter. This omission bypasses symlink validation, allowing a malicious user to specify a path that is a symlink to an arbitrary directory on the system. This path is then passed to a cron job.

Froxlor\Cron\System\ExportCron::createCustomerExport

lib/Froxlor/Cron/System/ExportCron.php

This function is executed by a cron job with root privileges. It takes the destination directory path, which is controlled by the user via the `DataDump.add` API call. The function executes `chown -R` on this path. Since `chown -R` follows symlinks, and the path was not validated for symlinks, an attacker can cause the command to change the ownership of arbitrary system directories (e.g., /etc), leading to full privilege escalation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-75h4-c557-j89r: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

Summary

Details

GHSA-75h4-c557-j89r:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

7.5

7.5

Technical Details

Basic Information

Basic Information

GHSA-75h4-c557-j89r: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

Summary

Details

PoC

Impact

Recommended Fix

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-75h4-c557-j89r: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

Summary

Details

GHSA-75h4-c557-j89r:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

7.5

7.5

Technical Details

Basic Information

Basic Information

GHSA-75h4-c557-j89r: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

Summary

Details

PoC

Impact

Recommended Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI