CVE-2026-90767
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Kelemahan
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.
Referensi
- https://github.com/froxlor/Froxlor
- https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Api/Commands/SshKeys.php
- https://github.com/froxlor/Froxlor/blob/2.3.10/lib/Froxlor/Cron/System/SshKeys.php
- https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f
- https://www.vulncheck.com/advisories/froxlor-before-2.3.12-ssh-key-injection-via-authorized-keys
- https://github.com/froxlor/Froxlor/security/advisories/GHSA-p3v3-74gc-jh5f
Temukan bug sebelum penyerang menemukannya.
Masuk dengan GitHub dan jalankan audit pertama Anda dalam waktu kurang dari satu menit. Paket gratis tidak memerlukan kartu kredit.