CVE-2024-58383

Froxlor before 2.2.0 (through 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via its XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On hosts with world-readable parent directories — the default on Debian 12 — any unprivileged local user, including virtual hosting customers without SSH who can upload PHP/CGI scripts, can read the file and recover the Froxlor database credentials. With database access, an attacker can rewrite an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately escalate to root on the host. Only instances configured to use pure-ftpd are affected. No public proof of concept exists and no exploitation has been observed; the issue is not in the CISA KEV catalog.

What to do: Upgrade to Froxlor 2.2.0 final or later, which no longer writes the pure-ftpd MySQL config as world-readable. As an immediate mitigation, set /etc/pure-ftpd/db/mysql.conf (and its parent directories) to restrictive permissions (e.g., chmod 600, owned by root), then rotate the Froxlor SQL user's password. Afterward, audit the Froxlor database and admin accounts for modified password hashes or TOTP seeds and review web/PHP logs for suspicious reads of the config path by hosted users.