CVE-2024-58383 in Froxlor
Summary
by MITRE • 09/14/2026
Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in versions of Froxlor prior to 2.2.0, including the release candidate up to 2.2.0-rc3, represents a critical misconfiguration leading to unauthorized access through improper file permission management. The core technical flaw lies in the generation and storage of database credentials within the configuration file for pure-ftpd located at /etc/pure-ftpd/db/mysql.conf. This specific file contains plaintext passwords for the Froxlor SQL user account responsible for managing the application's backend data. During the installation or reconfiguration process, the system utilizes XML configuration templates found in the lib/configfiles/ directory to write this sensitive information to disk. However, these templates incorrectly assign a permission mode of 0644 to the generated file. This octal value indicates that while the owner has read and write permissions, both the group and all other users on the system are granted read access. Consequently, any user account with local shell or script execution capabilities can inspect this file without restriction.
The operational impact is severe due to the default directory structure on Debian 12 systems where /etc/pure-ftpd/db/ resides in a world-readable parent directory hierarchy. This environmental factor exacerbates the vulnerability by ensuring that even if individual file permissions were tighter, the path traversal or simple listing of directories would still expose the sensitive configuration files to any local user. The threat actor profile includes unprivileged local users who may not have SSH access but possess the ability to execute commands or upload scripts such as PHP or CGI applications through web-facing services managed by Froxlor itself. Once an attacker gains read access to mysql.conf, they extract the database credentials which provide direct authentication against the underlying MySQL or MariaDB instance used by Froxlor. This bypasses application-level security controls and grants the attacker full administrative privileges over the database schema.
With control of the database, the attacker can perform a series of actions that lead to complete system compromise. The most immediate consequence is the ability to alter an administrator's password hash within the Froxlor user table. By modifying this field, the attacker sets their own known plaintext password for an admin account. Additionally, they can reset or remove the Time-based One-Time Password (TOTP) seed associated with two-factor authentication mechanisms, effectively disabling multi-factor security controls that might otherwise protect the administrative interface. After updating these credentials in the database, the attacker logs into the Froxlor web administration panel as a legitimate administrator. From this privileged position within the application, they can leverage existing features or vulnerabilities to execute system commands on the host server. Since Froxlor administrators typically have elevated privileges for managing servers and services, this access chain culminates in root-level control over the underlying operating system, allowing for data exfiltration, persistence installation, or further lateral movement across the network infrastructure.
This vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource, as it involves assigning overly permissive file permissions to a resource containing sensitive authentication credentials. It also maps to ATT&CK technique T1098.004: SSH Authorized Keys Modification if the attacker were to modify keys directly, but more accurately reflects T1530: Data from Local System and T1078: Valid Accounts through the database credential theft and subsequent admin login. To mitigate this issue, administrators must upgrade Froxlor to version 2.2.0 or later where these permission defaults have been corrected. For systems running affected versions that cannot be immediately upgraded, manual remediation is required by changing the permissions of /etc/pure-ftpd/db/mysql.conf to a restrictive mode such as 0640 or 0600, ensuring only the root user and potentially the ftpd service group can read it. Furthermore, administrators should audit other configuration files in similar directories for incorrect permission settings and ensure that database passwords are not stored in plaintext within world-readable locations. Implementing strict file integrity monitoring and regular audits of sensitive configuration paths will help detect such misconfigurations before they lead to full system compromise.