CVE-2024-58383 froxlor CVE debrief

Who should care

System administrators and security teams responsible for Froxlor instances, especially those using pure-ftpd, should assess exposure and prioritize remediation. This vulnerability is particularly relevant for environments where unprivileged local users can execute commands or code, including virtual users without SSH access who can upload PHP/CGI scripts.

Why it matters

CVE-2024-58383 is a high-severity vulnerability in Froxlor that allows unprivileged local users to obtain database credentials and potentially gain root privileges. It affects instances configured to use pure-ftpd and requires immediate attention from system administrators and security teams.

• Unprivileged local users can obtain Froxlor database credentials
• Database access can be used to alter administrator credentials and TOTP seeds
• Successful exploitation can lead to login as a Froxlor administrator
• Root privileges can be ultimately gained through this vulnerability

Technical summary

Froxlor before 2.2.0 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via XML configuration templates. This file contains the Froxlor SQL user's password. On systems with world-readable parent directories (e.g., Debian 12 default), any unprivileged local user can read the file and obtain Froxlor database credentials. This can be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and gain root privileges. Only instances configured to use pure-ftpd are affected.

Defensive priority

Assess exposure and prioritize remediation for Froxlor instances configured to use pure-ftpd, especially where unprivileged local users can execute commands or code.

Recommended defensive actions

• Review and adjust permissions for /etc/pure-ftpd/db/mysql.conf to restrict access
• Update Froxlor to version 2.2.0 or later
• Monitor for suspicious activity related to pure-ftpd and Froxlor database access
• Consider implementing additional security measures for local user privilege escalation
• Perform a thorough review of current system configurations and user privileges
• Ensure that all relevant logs are monitored for unusual activity
• Implement asset inventory to track Froxlor instances and their configurations

Evidence notes

The Froxlor configuration generates /etc/pure-ftpd/db/mysql.conf with mode 0644, containing the Froxlor SQL user's password. On systems with world-readable parent directories, unprivileged local users can read the file and obtain database credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.