Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

Summary

Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

Affected versions

• froxlor froxlor

  fixed in 2.3.15

References 5