Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.

Affected: Packagist: froxlor/froxlor

### Summary Froxlor 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests.

As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access.

### Details The customer-facing FTP account page builds the shell selector from `system.available_shells`, which shows that the product intends the setting to act as the authorization boundary:

```php // customer_ftp.php:138-149 $shells = [ '/bin/false' => '/bin/false' ]; $availableshells = explode(',', Settings::Get('system.available_shells')); if (is_array($availableshells) && !empty($availableshells)) { foreach ($availableshells as $shell) { $shells[trim($shell)] = trim($shell); } } ```

The request handler forwards posted form data directly into the FTP API command implementation:

```php // customer_ftp.php:170-172 if ($action == 'edit' && Request::post('send') == 'send') { $result = $log->logAction(USR_ACTION, LOG_INFO, "edited ftp-account #" . $id); Commands::get()->apiCall('Ftps.update', Request::postAll()); } ```

On the s…

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.