Executive brief
Froxlor, a server management control panel, stores database credentials in a configuration file with world-readable permissions. Unprivileged users on the system—including hosted website administrators who can upload scripts—can read this file to obtain database login credentials. With database access, attackers can modify administrator accounts and escalate privileges to root on affected systems running pure-ftpd.
Technical details
Froxlor 2.1.9 through 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via XML configuration templates, exposing the SQL_UNPRIVILEGED_PASSWORD credential. Although the file is readable only by the owning user and group, parent directories (/etc/pure-ftpd/db/, /etc/pure-ftpd/, /etc/) are world-readable by default on Debian systems, allowing any system user to read the password file. This affects only instances configured to use pure-ftpd as the FTP daemon. An unprivileged attacker with local code execution—including virtual hosting users who can upload PHP or CGI scripts—can extract database credentials and subsequently modify Froxlor administrator password hashes and TOTP seeds to gain administrative access and execute arbitrary commands as root. The vulnerability is resolved in Froxlor 2.2.0 and later.
Affected products
- Froxlor Froxlor before 2.2.0 (including 2.2.0-rc3)
Timeline
- 2024-08-23: disclosed: GitHub Security Advisory GHSA-34qg-65m4-f23m published
- 2024-09-14: advisory: NVD advisory published as CVE-2024-58383