Technical impact
Froxlor version 2.3.6 contains a symlink‑following vulnerability in the SSH key synchronization routine for customer FTP accounts. The code appends user supplied keys to a file named ~/.ssh/authorized_keys without checking whether the target is a symbolic link. Based on the description, it is inferred that the attacker must have local shell access to the customer account in order to modify files in the home directory. The weakness is a classic path traversal flaw (CWE‑59) that allows an attacker with such access to point the ~/.ssh/authorized_keys file to /root/.ssh/authorized_keys. When the privileged Froxlor cron task later synchronizes keys, it writes the attacker’s key into the root authorized_keys file, thereby granting the attacker root login access over SSH.
Affected Systems
The flaw exists in Froxlor 2.3.6. Version 2.3.7 includes a patch that removes the unchecked symlink resolution. The vulnerability is limited to the SSH key sync process used for regular customer FTP users, and it requires that the attacker already has a writable shell account for the customer.
Risk and Exploitability
With a CVSS score of 8.8 the potential impact is very high, and while an EPSS score is not available, the attack does not require privileged network exposure; it relies on a local customer account that can be compromised via standard user credential weaknesses. The vulnerability is not listed in the CISA KEV catalog, but its high severity and the ease of local exploitation make it a serious risk for systems that run Froxlor without the recent patch.
Github GHSA