CVE-2024-58383: Froxlor before 2.2.0 Insecure File Permissions mysql.conf
Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.2.0 - Configuration
For instances configured to use pure-ftpd, ensure /etc/pure-ftpd/db/mysql.conf is generated with restrictive permissions (mode 0600) rather than 0644 so unprivileged local users cannot read the Froxlor SQL user password contained in the file. Affected: Froxlor before 2.2.0 (including 2.2.0-rc3).
Froxlor (pure-ftpd XML templates / lib/configfiles/ mysql.conf generation) /etc/pure-ftpd/db/mysql.conf file permissions = 0600 (instead of 0644) - Compensating control
Limit access to the filesystem paths containing /etc/pure-ftpd/db/mysql.conf by tightening parent directory permissions so they are not world-readable (the issue is enabled when parent directories are world readable, e.g., default on Debian 12).
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Froxlor instances configured to use pure-ftpd are affected. Exposure is especially likely where the parent directories of /etc/pure-ftpd/db/mysql.conf are world-readable, which is the default on Debian 12.
Does an attacker need SSH access to exploit this?
No. Any unprivileged local user who can execute commands or code on the host can read the file; this can include virtual users without SSH access who can upload PHP or CGI scripts.
What can an attacker do with the exposed credentials?
The Froxlor SQL credentials can be used to access the database and alter an administrator's password hash and TOTP seed. This can enable Froxlor administrator access and ultimately root privileges.