CVE-2024-58383 froxlor CVE debrief

Who should care

System administrators and security teams responsible for Froxlor installations, especially those using pure-ftpd, should assess exposure and prioritize remediation. This includes reviewing current Froxlor versions, verifying configuration settings, and implementing necessary updates or mitigations. Security teams should also monitor for suspicious activity and verify the integrity of Froxlor database credentials. Additionally, operators and platform teams,

Why it matters

CVE-2024-58383 allows unprivileged local users to obtain Froxlor database credentials due to insecure file permissions, potentially leading to privilege escalation and requiring immediate attention from system administrators and security teams.

• Unprivileged local users can read sensitive database credentials
• Database access can be leveraged to alter administrator credentials
• Potential for local privilege escalation to root privileges
• Verification of Froxlor version and configuration is necessary

Technical summary

Froxlor versions before 2.2.0 generate the /etc/pure-ftpd/db/mysql.conf file with insecure permissions (mode 0644). This allows unprivileged local users to read the file and obtain Froxlor database credentials. The vulnerability affects systems using pure-ftpd and can lead to privilege escalation. The issue arises from the insecure configuration in lib/configfiles/, and defenders should verify Froxlor version and configuration to assess exposure. Immediate remediation is necessary to prevent potential attacks. The vulnerability has a CVSS score of 8.4, indicating high severity.

Defensive priority

Local privilege escalation via insecure file permissions

Recommended defensive actions

• Review and correct file permissions for /etc/pure-ftpd/db/mysql.conf
• Verify and restrict access to Froxlor database credentials
• Update Froxlor to version 2.2.0 or later
• Monitor for suspicious activity related to pure-ftpd and Froxlor
• Perform vulnerability scanning to identify exposed Froxlor instances
• Implement compensating controls for exposed systems
• Track remediation progress and verify fixes

Evidence notes

The Froxlor configuration generates an insecure /etc/pure-ftpd/db/mysql.conf file with world-readable permissions (mode 0644), potentially exposing database credentials to unprivileged local users. This issue arises from the XML configuration templates in lib/configfiles/ and affects systems where parent directories are world-readable, such as Debian 12. The Froxlor SQL user's password is included in the file, which can be read by any unprivileged local user able to execute commands or code on the host.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.