Froxlor SSH Public Key Injection Leading to Unauthorized Access

Executive Summary

Froxlor before version 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint. This allows attackers to inject arbitrary lines into authorized_keys files by exploiting newline characters in the input. The system treats subsequent lines as comments, enabling the addition of malicious SSH key entries with option directives like command="...". These injected entries persist even after key deletion or SSH access revocation, granting unauthorized persistent access.

Useful 0 Not Useful 0

Detection Guidance

Check Froxlor versions below 2.3.12 by running: froxlor --version. Inspect authorized_keys files in user home directories for unexpected multi-line entries or malicious options like command="...". Use grep to search for froxlor:id= comments in ~/.ssh/authorized_keys files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with SSH access to gain persistent unauthorized access to your account. They can inject malicious SSH key entries that survive key deletion or SSH access revocation. The impact is limited to the attacker's own account but results in unauthorized persistence and integrity issues in the authorized_keys file.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Review and manually clean all authorized_keys files for injected entries. Disable SSH access for affected users until verification. Monitor for unauthorized persistence.

Useful 0 Not Useful 0