CyberRota Analysis
AI-GeneratedFroxlor versions prior to 2.3.12 are vulnerable due to improper validation of multi-line SSH public keys, which allows attackers to inject arbitrary lines into authorized_keys files. This flaw can lead to persistent unauthorized access, even after key deletion or SSH access revocation, posing a significant security risk. System administrators and organizations using Froxlor should prioritize upgrading to the latest version to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that survives key deletion and SSH access revocation.