Froxlor 2.3.10 and earlier contain a TOCTOU race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The vulnerability arises because containment and symlink validation are performed only at check time, but the actual file write operations occur later with the filesystem path re-resolved as root, without pinning the file descriptor or preventing symlink following. On systems where the setting system.allow_customer_shell=1 is enabled, a customer with local shell access can atomically replace their ~/.ssh directory with a symlink after the check and before the write. This causes the root-run cron to append the customer's public key to /root/.ssh/authorized_keys and change ownership of /root/.ssh to the customer, resulting in full root compromise. The cron runs repeatedly, allowing unlimited exploitation attempts. This issue is a residual race condition bypassing a previous fix and is resolved in Froxlor 2.3.12.

An attacker with local shell access and the non-default setting system.allow_customer_shell=1 enabled can escalate privileges to root by exploiting the race condition in the SSH key synchronization cron. This leads to full root compromise of the host running the Froxlor panel, including unauthorized access to root SSH keys and control over the system.

Upgrade Froxlor to version 2.3.12 or later, where this TOCTOU race condition is fixed. Until then, consider disabling the system.allow_customer_shell setting to prevent customers from having local shell access, thereby mitigating the risk of exploitation.