Froxlor up to 2.1.x Configuration Template mysql.conf weak password hash

Summaryinfo

A vulnerability identified as problematic has been detected in Froxlor up to 2.1.x. The impacted element is an unknown function of the file /etc/pure-ftpd/db/mysql.conf of the component Configuration Template. This manipulation causes weak password hash. This vulnerability is handled as CVE-2024-58383. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Froxlor up to 2.1.x. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the file /etc/pure-ftpd/db/mysql.conf of the component Configuration Template. The manipulation with an unknown input leads to a weak password hash vulnerability. The CWE definition for the vulnerability is CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. As an impact it is known to affect confidentiality. The summary by CVE is:

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-58383 since 08/16/2026. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 2.2.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Froxlor

Version

• 2.0
• 2.1

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion