Froxlor Server Administration Panel CRLF Injection Vulnerability

froxlor, a server administration panel, is affected by a CRLF injection vulnerability in versions 2.3.10 and earlier. The Validate::validateUrl check rejects carriage return and line feed characters only in the path, query, and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2.

An authenticated low-privilege customer with subdomain-create rights (no admin or change_serversettings privilege required) can supply a subdomain redirect URL that carries a CR/LF payload in the userinfo portion, for example http://user%0areturn 200 "pwned";%0a@evil.com/. The value passes validation, survives IDNA encoding, and is written verbatim into the generated nginx or Apache vhost configuration.

• Affected versions: 2.3.10 and earlier
• Fixed version: 2.3.12
• Impact: arbitrary web-server configuration injection, server-wide effect, response hijacking or local file disclosure