CVE-2026-100713

Executive Summary

CVE-2026-100713 is a time-of-check time-of-use (TOCTOU) race condition in the Froxlor server management panel's SSH key synchronization cron job (lib/Froxlor/Cron/System/SshKeys.php, method SshKeys::generateFiles), affecting Froxlor 2.3.10 and earlier. On installations where the non-default setting system.allow_customer_shell=1 is enabled, an authenticated customer with local shell access can swap their ~/.ssh directory for a symlink between the validation step and the root-run write step, causing the cron to append the attacker's public key to /root/.ssh/authorized_keys and to change ownership of /root/.ssh to the customer — yielding full root compromise of the panel host.

Technical Analysis

The vulnerability is a classic TOCTOU race (CWE-367) rooted in the separation of the containment check from the privileged write. The vulnerable component is the SSH key synchronization cron implementation at lib/Froxlor/Cron/System/SshKeys.php, specifically the SshKeys::generateFiles function.

According to the NVD description, the path containment and symlink validation is performed by FileDir::makeCorrectDir() and FileDir::makeCorrectFile(). Critically, this validation executes only at check time. After validation completes, the cron performs a database round-trip and file reads before it re-resolves the live filesystem path as root at write time. Because the path is re-resolved rather than pinned to a file descriptor or inode — no O_NOFOLLOW and no openat2(RESOLVE_NO_SYMLINKS) protections are applied — any modification to the filesystem hierarchy made by the attacker in the interval between the check and the write is honored by the privileged operation.

The privileged write operation is characterized in the description as file_put_contents with the FILE_APPEND and LOCK_EX flags, immediately followed by chmod, chown, and chgrp calls executed as root. The combination of append-mode writes, permission changes, and ownership changes applied to a path that is re-resolved at write time is what makes the attack attractive: the attacker does not need the cron to write to a new file, only to append to an existing target that the attacker has redirected.

The attacker requires local shell access. Froxlor's default configuration does not grant this; the setting system.allow_customer_shell must be set to 1 (a non-default, explicitly opt-in configuration). When enabled, a customer can create files in their own home directory, including their ~/.ssh directory, and can therefore remove that directory and replace it with a symlink atomically (e.g., via rename). If the timing of the symlink swap falls within the window between FileDir::makeCorrectDir()/makeCorrectFile() validation and the root-run file_put_contents plus chmod/chown/chgrp sequence, the privileged process follows the symlink and operates on /root/.ssh/authorized_keys.

The root cause is the absence of path or file-descriptor pinning. The fix class for such issues is to hold an open file descriptor for the validated object and perform all subsequent operations on that descriptor, or to open the final component with O_NOFOLLOW / openat2 with RESOLVE_NO_SYMLINKS so that a symlink substitution is rejected at open time. The description explicitly notes that neither technique is present in the vulnerable version.

The description further states that this is a residual race that bypasses the check-time fix previously introduced for GHSA-mq5v-.... This indicates the earlier remediation hardened the validation step but did not address the race window inherent to re-resolving the path at write time. Fixing only the check does not eliminate a TOCTOU condition; the remediation must make the check and the use atomic with respect to the attacker-controlled path.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing. EPSS has not scored this CVE, and there is no evidence of CISA KEV listing or active exploitation in the wild.

Exploitation Scenarios

The attack chain below is inferred from the vulnerability class (TOCTOU in a privileged cron) and the specific mechanism documented in the NVD description. No public PoC is available; steps involving exact commands are described at the vulnerability-class level only, using names that appear verbatim in the source description.

1. Reconnaissance and target identification. The attacker first identifies a Froxlor panel installation running version 2.3.10 or earlier and confirms that the SSH key synchronization cron is active. The critical precondition is that system.allow_customer_shell=1, meaning the installation grants customers local shell access. The attacker must hold a valid customer account on the panel, since the race relies on the ability to manipulate a home directory that the cron will visit.

2. Triggering the flaw class. The attacker prepares the swap by creating a legitimate-looking ~/.ssh directory in their home directory containing a public key file, so that the state observed at check time is valid and passes FileDir::makeCorrectDir() and FileDir::makeCorrectFile(). The attacker then waits for the cron interval. When the root-run SshKeys::generateFiles routine begins processing the customer's SSH key, the attacker atomically replaces the ~/.ssh directory with a symlink pointing to /root/.ssh. Atomic replacement (for example, via rename of a symlink over the directory) is required so that the swap succeeds as a single filesystem operation within the race window.

3. Execution. The privileged cron completes its validation against the legitimate directory, then performs its database round-trip and file reads. During that window, the symlink swap lands. When the cron re-resolves the live filesystem path as root at write time and executes file_put_contents with FILE_APPEND|LOCK_EX, the write follows the symlink and appends the attacker's public key to /root/.ssh/authorized_keys. The immediately following chmod, chown, and chgrp calls likewise operate through the symlink and change ownership of /root/.ssh to the customer account.

Because the cron re-runs on every interval, the attacker has unlimited attempts and can retry until the timing window is hit. The race is the only source of nondeterminism; on a busy host with a predictable cron schedule, the window is repeatable.

4. Post-exploitation impact. Once the attacker's public key is present in /root/.ssh/authorized_keys and /root/.ssh ownership has been changed to the customer, the attacker can authenticate to the panel host as root via SSH. This is full root compromise of the panel host: complete control over the Froxlor installation, all hosted customer data, all managed domains and mailboxes, the panel database, and any other services on the host. Because Froxlor is a hosting control panel, the blast radius extends to every tenant on the platform.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 7.8 (HIGH).

• Attack Vector (L — Local): exploitation requires local shell access on the panel host, consistent with the system.allow_customer_shell=1 precondition.
• Attack Complexity (H — High): the attack depends on winning a race window, which requires timing precision and repeated attempts.
• Privileges Required (L — Low): an authenticated customer account on the panel is sufficient; no administrative privilege is needed.
• User Interaction (N — None): no victim action is required; the cron executes autonomously.
• Scope (C — Changed): the vulnerable component is the Froxlor cron operating on customer-controlled data, but the impact crosses a security boundary — the customer gains control of root-owned resources and ultimately the root account. The changed scope reflects that the compromise escapes the customer's authorization context.
• Confidentiality, Integrity, Availability (H/H/H): full root access yields complete read access to all host data, the ability to modify any file or service, and the ability to destroy or ransom the host.

Business impact is severe for hosting providers and managed service providers running Froxlor with customer shell access enabled. A single malicious or compromised customer account can escalate to root on the entire panel host, exposing all tenants' data, mail, databases, and websites. The non-default precondition (allow_customer_shell=1) limits the exposed population, but for organizations that intentionally enable it, the vulnerability constitutes a complete multi-tenant isolation failure. The patch confidence is 0/4: no patch evidence from any tracked source was found in the data provided, although the description states the issue is fixed in a later release.

Detection Guidance

Sigma Rule

title: Froxlor SSH Key Cron TOCTOU Symlink Swap to Root Authorized Keys
id: 9f2c1a44-7b6e-4d0a-9c3e-5a1f0e2b8d71
status: experimental
description: Detects suspicious modification of /root/.ssh/authorized_keys or ownership changes to /root/.ssh consistent with CVE-2026-100713 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-100713
author: Threat Intelligence Team
date: 2026/01/01
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.100713
logsource:
    product: linux
    service: auditd
detection:
    selection_file:
        type: 'PATH'
        name:
            - '/root/.ssh/authorized_keys'
            - '/root/.ssh'
    selection_owner:
        type: 'SYSCALL'
        syscall:
            - 'chown'
            - 'chmod'
            - 'chgrp'
        exe|endswith:
            - '/php'
    condition: selection_file and selection_owner
falsepositives:
    - Legitimate root SSH key administration by an administrator
    - Configuration management tools updating root authorized_keys
level: high

YARA Rule

rule CVE_2026_100713_Froxlor_SshKeys_TOCTOU
{
    meta:
        description = "Detects Froxlor SSH key synchronization code paths associated with the CVE-2026-100713 TOCTOU race"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100713"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cls = "SshKeys" ascii
        $fn  = "generateFiles" ascii
        $path = "lib/Froxlor/Cron/System/SshKeys.php" ascii
        $put  = "file_put_contents" ascii
        $app  = "FILE_APPEND" ascii
        $lock = "LOCK_EX" ascii
        $chown = "chown" ascii
        $chmod = "chmod" ascii
        $chgrp = "chgrp" ascii

    condition:
        (uint16(0) == 0x3C3F or true) and
        (
            $path or
            ($cls and $fn) or
            ($put and $app and $lock and 2 of ($chown, $chmod, $chgrp))
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 22 (msg:"CVE-2026-100713 Froxlor SSH Key Cron TOCTOU - Potential Root SSH Key Injection"; flow:to_server,established; content:"SSH-2.0-"; depth:8; content:"ssh-rsa"; distance:0; classtype:attempted-admin; reference:cve,2026-100713; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-100713; sid:2026100713; rev:1;)

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and
process.name in ("chown", "chmod", "chgrp") and
process.parent.name like "php*" and
process.args like "/root/.ssh*"

Splunk SPL Query

index=linux sourcetype=auditd
(proc_name=chown OR proc_name=chmod OR proc_name=chgrp OR proc_name=php)
(path="/root/.ssh/authorized_keys" OR path="/root/.ssh")
| stats count min(_time) as firstTime max(_time) as lastTime by host, proc_name, path, uid
| where uid=0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="froxlor,cve-2026-100713,">
  <rule id="100713" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.key">ssh_root_write</field>
    <description>CVE-2026-100713: Possible Froxlor SSH key cron TOCTOU symlink swap writing to /root/.ssh</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="100714" level="12">
    <if_sid>80700</if_sid>
    <match>/root/.ssh</match>
    <regex>chown|chmod|chgrp</regex>
    <description>CVE-2026-100713: Ownership/permission change on /root/.ssh by non-root context process</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Froxlor 2.3.12; however, no vendor advisory, commit reference, or downstream patch source could be corroborated in the provided data. Treat all systems as unpatched until the fixed release is verified.

1. Immediate mitigations:

• Disable customer shell access unless operationally required. If system.allow_customer_shell is not needed, set it to 0 (or remove the setting). This removes the local-shell precondition and closes the attack vector entirely.
• Where shell access cannot be disabled, restrict where the Froxlor SSH key cron may operate and ensure the web/cron user cannot influence root-owned paths. Audit any existing symlinks under customer home directories.
• Monitor and alert on writes to /root/.ssh/authorized_keys and on ownership changes to /root/.ssh, as described in the detection sections above.
• Review /root/.ssh/authorized_keys for unexpected keys and validate ownership of /root/.ssh (must be root:root, mode 700) on all affected hosts.

2. Patch/upgrade steps:

• Upgrade Froxlor to version 2.3.12, which the NVD description states contains the fix for this residual race.
• Because patch confidence is 0/4, independently verify the fixed release artifact and its changelog before relying on it. Test the upgrade in a staging environment first.
• After upgrading, re-validate that customer shell access settings match policy and that no unauthorized keys remain in root's authorized_keys.

3. Long-term hardening:

• Treat TOCTOU in privileged file operations as a design defect. Where root-run code operates on user-controlled paths, require file-descriptor pinning or openat2 with RESOLVE_NO_SYMLINKS, and reject symlinks at open time with O_NOFOLLOW.
• Enforce least privilege for cron components; avoid running SSH key synchronization as root where a less privileged helper can perform the operation.
• Apply defense in depth: immutable/append-only logging of root SSH key changes, file integrity monitoring on /root/.ssh, and periodic review of panel configuration for non-default settings that broaden the attack surface.

References

• NVD — CVE-2026-100713: https://nvd.nist.gov/vuln/detail/CVE-2026-100713
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• Froxlor project (vendor release source for version 2.3.12): https://froxlor.org/
• GHSA-mq5v-... (prior advisory whose check-time fix this residual race bypasses; partial identifier as referenced in the NVD description): https://github.com/advisories
• FIRST EPSS — not yet scored for this CVE (no EPSS value available at time of writing): https://www.first.org/epss/