Skeletonsec

Low-privilege station users can perform a CRLF injection, which occurs when carriage return (CR) and line feed (LF) characters are improperly handled, allowing an attacker to insert new lines into a document. Users with `Station:MountPoints` or `Station:RemoteRelays` permissions can embed these sequences in the `display name` values of mounts or remote relays. This allows the injection of `FileN=` and `TitleN=` lines into the public `playlist.pls` file, potentially redirecting guest listeners to streams controlled by the attacker while appearing under the victim station's name.

When parsing an uploaded Helm chart, the software decompresses the archive and reads every tar entry to locate `Chart.yaml` without limiting the decompressed size. This process occurs before the package size quota is verified, as the quota only accounts for the compressed upload size. A user with package write access can upload small, highly compressed archives, causing the server to consume CPU time proportional to the decompressed size, which degrades the availability of the instance. This issue does not allow code execution or data access.

An SQL Injection issue exists in the dashboard widget data API endpoint '/api/data/{type}'. This occurs because chart filter parameters provided by the client are not properly validated before being used in database queries that generate dashboard chart data. An authenticated user with API access can use blind SQL injection—a technique used to retrieve data from a database by asking true/false questions—to read arbitrary information from the database, including contact details, marketing data, and user account password hashes. Additionally, the injected SQL can be used to slow down queries, potentially impacting availability. Data modification is not possible, and exploitation requires the Mautic API to be enabled.

An authentication bypass exists where verification codes are not invalidated for active users after use. An attacker who obtains a verification code sent via email can submit it to the 'users/set-password' endpoint after the victim has already verified an email change. This allows the attacker to reset the password and take over the account. The issue occurs because the 'users/verify-email' endpoint fails to properly invalidate the code.

The `UnTar. safe extractall` function in `src/pyload/plugins/extractors/UnTar.py` fails to call `TarInfo.isdev` to reject special tar member types before executing `tarfile.extractall`. On Python 3.9 through 3.13 runtimes, which default to a fully trusted extraction filter, a user with ADD and STATUS permissions can upload a crafted archive to create character devices, block devices, or FIFOs (First-In-First-Out, a type of pipe used for inter-process communication). If the application runs with privileges that allow device creation, such as the root-based Docker deployment, this can expose raw devices and compromise the host. In non-root deployments, the creation of FIFOs can lead to system hangs or IPC confusion.

An insecure direct object reference (IDOR) occurs in the `PersonalAccountService` service. This issue allows users with Email Account scope access to retrieve IMAP passwords belonging to other users. An attacker who possesses a victim's Email Account record ID can request that specific record to steal stored IMAP credentials and gain unauthorized access to the victim's mailbox.

An authorization flaw exists in the tags tool within the `listpagestag` and `includepages` actions. These actions enumerate pages without applying read-ACL (Access Control List) filtering, which is a mechanism used to restrict access to specific pages based on user permissions. Unauthenticated or unprivileged attackers can embed these actions using a specific tag or page name to disclose the names and body-derived titles of pages that are restricted by ACLs.

An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary URLs. This is achieved by providing a syndication action via the `content` parameter of the render handler. Attackers can target internal hosts and ports, retrieve fetched feed content within the rendered page, and trigger the download of feed enclosures into the files directory.

An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary hosts and ports. This is achieved by submitting the `url` parameter of the {{valeur}} action through the `content` parameter of the 'handlers/page/render.php' endpoint. This flaw enables the probing of internal HTTP services and the retrieval of response content that matches fiche markup.

An unauthenticated attacker can perform a blind server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This is possible via the '/api/entries/bazarlist' endpoint using the `idtypeannonce` parameter. The issue exists because the `isValidURL()` function always returns true, allowing the `loadURLContent()` function to use curl to fetch internal URLs. This can be used to probe internal networks and access internal services or metadata endpoints.

An issue in `LostPasswordAction.php` allows unauthenticated attackers to confirm registered email addresses by analyzing differing server responses. This occurs on the MotDePassePerdu recovery page, which lacks rate limiting, enabling attackers to identify valid accounts for targeted phishing or password-spraying attacks.

An authenticated customer with the export feature enabled can achieve host root and cross-tenant compromise. The issue occurs because the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination. Specifically, the `makeCorrectDir()` function in `FroxlorFileDir` contains an off-by-one error during its path-component walk, skipping the first segment below the customer home directory. Additionally, the guard in `ExportCron.php` only checks the final component using `is link()`. An attacker can schedule an export to a subdirectory and replace an intermediate path component with a symlink before the root-owned cron executes. This causes the `chown -R` command to recursively change the ownership of the linked directory tree, such as /etc, to the customer's UID.

The software fails to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. This allows attackers who possess hijacked sessions, valid API keys, or 2FA trust tokens to maintain full account access even after a password rotation, effectively bypassing incident response measures.

An issue exists where two-factor authentication (2FA) is disabled immediately upon a GET request to the 2FA management page, such as the endpoint '/customer index.php?page=2fa&action=delete'. This process occurs without requiring confirmation, re-authentication, or a CSRF (Cross-Site Request Forgery) token—a type of attack that forces an authenticated user to execute unwanted actions. Because the global CSRF middleware only protects POST, PUT, PATCH, and DELETE requests, and the session cookie uses SameSite=Lax, a cross-site top-level navigation can silently clear the `type 2fa` and `data 2fa` variables. Both customer and admin 2FA handlers are affected, allowing an attacker to reduce an account to password-only authentication if a logged-in user follows a crafted link.

A time-of-check time-of-use (TOCTOU) race condition exists in the SSH key synchronization cron within the `SshKeys::generateFiles()` function located in `lib/Froxlor/Cron/System/SshKeys.php`. TOCTOU is a software bug where a program checks the state of a resource before using it, but the state changes between the check and the use. The validation performed by `FileDir::makeCorrectDir()` and `makeCorrectFile()` occurs only at check time, while the filesystem path is re-resolved as root during the write process. On installations where the `system.allow customer shell` variable is set to 1, granting customers local shell access, an attacker can replace their `~/.ssh` directory with a symlink after the check but before the write. This allows the root-run cron to append the customer's public key to `/root/.ssh/authorized keys` and change the ownership of `/root/.ssh` to the customer, leading to full root compromise of the panel host.

Insufficient restriction and escaping of the `system.letsencryptchallengepath` setting allows for command injection. The value of this setting is concatenated unescaped into the acme.sh command line within the `lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php` file and executed by the root cron using the `FileDir::safe exec()` function. Since `safe exec()` only blacklists specific shell metacharacters, spaces and quotes remain, allowing the value to be split into additional acme.sh arguments. An administrator or an actor with permissions to modify settings, such as through the settings-import API, can inject options like `--renew-hook`, `--pre-hook`, or `--post-hook` to achieve arbitrary command execution as root during the next Let's Encrypt cron run, or use `--config-home` and `--cert-home` for arbitrary file writes.

An issue exists in the FTP data deletion cron task where the system is susceptible to arbitrary file deletion via symlink following. When an FTP account is deleted, cron task 8 (deleteFtpData) calls the `makeCorrectDir()` function without the `$fixed homedir` argument. This causes the system to skip the symlink component walk and execute `rm -rf` as root on the resulting path using only string-level guards. Because `makeCorrectDir()` appends a trailing slash, GNU rm dereferences symlinks used as intermediate or final path components. An authenticated customer with write access to the FTP home directory can create a symlink before the cron job executes, allowing the root process to recursively delete arbitrary directory trees. This can lead to cross-tenant data destruction and host denial of service.

User data export ZIP files contain live Time-based One-Time Password (TOTP) shared secrets in plaintext. An attacker who obtains these exported archives can extract the TOTP seed to generate valid one-time codes, allowing them to bypass two-factor authentication.

An issue exists where the admin dashboard API endpoints 'searches' and 'content-health' enforce authentication but fail to perform necessary permission checks. This allows any authenticated user, regardless of their privilege level, to access these endpoints and read site-wide search statistics and content-health counters.

An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve sensitive configuration data. The exposed information includes TLS private key file paths, socket configuration details, platform version, and debug flags, which could facilitate further targeted attacks.