CVE-2024-48651: ProFTPD Privilege Escalation Vulnerability

CVE-2024-48651 Overview

CVE-2024-48651 is an authorization vulnerability in ProFTPD through version 1.3.8b, fixed in commit cec01cc. The flaw lies in how ProFTPD handles supplemental group inheritance when the mod_sql authentication module returns no supplemental groups for an authenticated user. Under these conditions, the server can grant unintended access to GID 0 (the root group), enabling read access to files restricted to the root group. The issue is tracked as [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated FTP users authenticated through mod_sql may inherit GID 0 supplemental group membership, exposing files owned by the root group over FTP and SFTP.

Affected Products

ProFTPD versions up to and including 1.3.8b
Deployments using the mod_sql authentication module
Debian LTS distributions shipping vulnerable ProFTPD packages

Discovery Timeline

2024-11-29 - CVE-2024-48651 published to NVD
2024-11 - Debian LTS security advisory released for affected packages
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-48651

Vulnerability Analysis

ProFTPD assigns supplemental group memberships during session setup using pr_auth_getgroups(). When an authentication backend such as mod_sql returns no supplemental groups for the authenticated user, the session structures session.gids and session.groups remain unpopulated. Downstream code paths in the SFTP authentication module treat the absence of supplemental groups as inheritance from the parent process, which runs with GID 0. The authenticated user therefore receives unintended group membership in root.

The consequence is a confidentiality breach: files and directories readable by the root group become accessible to any user authenticated through mod_sql. The flaw does not directly enable code execution or modification of root-owned files, but it bypasses the intended group-based access control model.

Root Cause

The defect is a missing default in the supplemental group resolution logic. When pr_auth_getgroups() returns fewer than one group, ProFTPD did not initialize session.gids and session.groups to the user's primary GID. Subsequent privilege transitions inherited the parent process's group set, which includes GID 0.

Attack Vector

An attacker with valid SQL-backed FTP or SFTP credentials connects to the ProFTPD service and issues standard file retrieval commands against paths readable by GID 0. No memory corruption, protocol abuse, or additional privileges are required. Exploitation is purely a function of the inherited group set during the authenticated session.

// Patched logic from contrib/mod_sftp/auth.c
      session.groups == NULL) {
    res = pr_auth_getgroups(p, pw->pw_name, &session.gids, &session.groups);
    if (res < 1) {
      /* If no supplemental groups are provided, default to using the process
       * primary GID as the supplemental group.  This prevents access
       * regressions as seen in Issue #1830.
       */
      (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
        "no supplemental groups found for user '%s', "
        "using primary group %s (GID %lu)", pw->pw_name, session.group,
        (unsigned long) session.login_gid);

      session.gids = make_array(p, 2, sizeof(gid_t));
      session.groups = make_array(p, 2, sizeof(char *));

      *((gid_t *) push_array(session.gids)) = session.login_gid;
      *((char **) push_array(session.groups)) = pstrdup(p, session.group);
    }
  }

Source: ProFTPD commit cec01cc

Detection Methods for CVE-2024-48651

Indicators of Compromise

Successful FTP or SFTP RETR or GET operations against files owned by root:root from non-root users.
ProFTPD log entries showing user authentication via mod_sql followed immediately by access to paths normally restricted to GID 0.
Unexpected egress traffic from FTP servers correlating with reads of sensitive system files such as /etc/shadow when group-readable.

Detection Strategies

Audit ProFTPD versions across the estate using package inventory queries and flag any release prior to the cec01cc commit.
Enable ProFTPD's ExtendedLog directive to capture file transfer operations and the effective UID/GID of each session.
Correlate authentication backend (mod_sql) usage with file access events targeting root-group resources.

Monitoring Recommendations

Forward ProFTPD transfer and authentication logs to a centralized logging platform for retention and correlation.
Alert on transfers of files matched by sensitive-path patterns (for example, /etc/*, /root/*) initiated by authenticated FTP users.
Baseline normal SQL-authenticated user activity and trigger on deviations such as new file paths or higher transfer volumes.

How to Mitigate CVE-2024-48651

Immediate Actions Required

Upgrade ProFTPD to a build that includes commit cec01cc0a2523453e5da5a486bc6d977c3768db1 or apply the corresponding distribution patch.
For Debian-based systems, apply the updates referenced in the Debian LTS announcement.
Audit mod_sql user tables to confirm supplemental group assignments match the intended access model.

Patch Information

The upstream fix is committed in the ProFTPD repository as cec01cc, addressing Issue #1830. The patch initializes session.gids and session.groups with the user's primary GID when the authentication backend returns no supplemental groups, preventing inheritance of GID 0 from the parent process. See the ProFTPD security patch for the full change set.

Workarounds

Run the proftpd daemon under a non-root primary group so that group inheritance cannot leak GID 0 to authenticated sessions.
Configure explicit supplemental group entries for every mod_sql user so that pr_auth_getgroups() always returns at least one group.
Restrict mod_sql accounts to chrooted directories using DefaultRoot to limit which files an unintended GID 0 membership can reach.

bash

# Verify the running ProFTPD version and confirm patch level
proftpd -v

# Recommended hardening in proftpd.conf
DefaultRoot ~ !wheel
Umask 027
<IfModule mod_sql.c>
  SQLOptions noDisconnectOnError
</IfModule>