Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

• = 2.3.6

### Summary Froxlor 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. ### Details The customer-facing FTP account page builds the shell selector from `system.available_shells`, which shows that the product intends the setting to act as the authorization boundary: ```php // customer_ftp.php:138-149 $shells = [ '/bin/false' => '/bin/false' ]; $availableshells = explode(',', Settings::Get('system.available_shells')); if (is_array($availableshells) && !empty($availableshells)) { foreach ($availableshells as $shell) { $shells[trim($shell)] = trim($shell); } } ``` The request handler forwards posted form data directly i

GitHub Advisory Database

• ECOSYSTEM: introduced 2.3.6; fixed 2.3.7

### Summary Froxlor 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. ### Details The customer-facing FTP account page builds the shell selector from `system.available_shells`, which shows that the product intends the setting to act as the authorization boundary: ```php // customer_ftp.php:138-149 $shells = [ '/bin/false' => '/bin/false' ]; $availableshells = explode(',', Settings::Get('system.available_shells')); if (is_array($availableshells) && !empty($availableshells)) { foreach ($availableshells as $shell) { $shells[trim($shell)] = trim($shell); } } ``` The request handler forwards posted form data directly i

GitHub Advisory Database via OSV