Froxlor Command Injection via Lets Encrypt Challenge Path Setting

Froxlor before 2.3.12 contains a command injection vulnerability in its Let's Encrypt challenge path setting.

The system.letsencryptchallengepath setting is not restricted or escaped, unlike sibling settings hardened in GHSA-33mp. Its value is concatenated unescaped into the acme.sh command line in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec.

Because safe_exec only blacklists shell metacharacters such as ; | & > < \ $ ~ ?, spaces and quotes survive, the value is word-split into additional acme.sh arguments.

• An administrator, or any actor able to write settings (e.g. through the settings-import API), can inject acme.sh options such as --renew-hook, --pre-hook or --post-hook.
• This allows arbitrary command execution as root at the next Let's Encrypt cron run.
• Options like --config-home/--cert-home can be used for arbitrary file writes.
• Versions up to and including 2.3.10 are affected; fixed in 2.3.12.