CVE-2024-58383: Froxlor Information Disclosure Vulnerability

CVE-2024-58383 Overview

CVE-2024-58383 affects Froxlor server management panel installations before version 2.2.0, including release candidates up to and including 2.2.0-rc3. The vulnerability stems from insecure file permissions [CWE-732] on /etc/pure-ftpd/db/mysql.conf, which is generated with mode 0644 by the XML configuration templates in lib/configfiles/. This file contains the Froxlor SQL user's password in plaintext. Any unprivileged local user who can execute code on the host can read the file and obtain database credentials. Only Froxlor instances configured to use pure-ftpd are affected.

Critical Impact
Local attackers can read Froxlor database credentials, alter administrator password hashes and TOTP seeds, log in as an administrator, and escalate to root privileges.

Affected Products

Froxlor versions prior to 2.2.0
Froxlor 2.2.0-rc1, 2.2.0-rc2, and 2.2.0-rc3 release candidates
Deployments configured to use the pure-ftpd FTP server, particularly on Debian 12 where parent directories are world-readable by default

Discovery Timeline

2026-09-14 - CVE-2024-58383 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2024-58383

Vulnerability Analysis

Froxlor generates the pure-ftpd MySQL configuration file /etc/pure-ftpd/db/mysql.conf using XML templates located in lib/configfiles/. The generated file receives world-readable permissions (0644), even though it stores the Froxlor SQL user's password in cleartext. On Debian 12 and similar distributions, the parent directories are also world-readable by default, leaving no filesystem barrier to disclosure. Any local process running under an unprivileged account can open and read the file. This includes constrained tenants such as virtual users without shell access who can upload PHP or CGI scripts through hosted web workloads. The vulnerability falls under [CWE-732] Incorrect Permission Assignment for Critical Resource.

Root Cause

The configuration file generation logic in lib/configfiles/ does not restrict the mode of mysql.conf to owner-only access after writing sensitive credential material. The template writes the file with default permissions rather than applying 0600 and enforcing ownership by the pure-ftpd service user.

Attack Vector

An attacker with any form of local code execution reads /etc/pure-ftpd/db/mysql.conf to recover the Froxlor MySQL credentials. Using those credentials, the attacker connects to the Froxlor database and overwrites an administrator account's password hash and TOTP seed. The attacker then authenticates to the Froxlor web panel as an administrator. Because Froxlor administrators can define system-level tasks and configuration changes executed by privileged Froxlor components, the attacker escalates from unprivileged local user to root on the host.

Refer to the GitHub Security Advisory GHSA-34qg-65m4-f23m and the VulnCheck Advisory on Froxlor Permissions for full technical detail.

Detection Methods for CVE-2024-58383

Indicators of Compromise

Unexpected read access to /etc/pure-ftpd/db/mysql.conf from web server, PHP-FPM, or CGI worker processes.
Unauthorized MySQL client sessions authenticating with the Froxlor database user from local sockets or 127.0.0.1.
Modifications to the Froxlor panel_admins table, specifically to password and loginfail_count or TOTP seed columns, outside normal administrative activity.
New or unexpected Froxlor administrator logins followed by system-level configuration changes or cron/task edits.

Detection Strategies

Audit file permissions across Froxlor hosts and alert when /etc/pure-ftpd/db/mysql.conf is present with mode broader than 0600.
Enable Linux audit rules (auditd) on the file path to log every open() and read() call with the invoking UID and process name.
Monitor MySQL general or audit logs for the Froxlor SQL user connecting from unusual process contexts such as www-data shells.

Monitoring Recommendations

Baseline legitimate access to /etc/pure-ftpd/db/ and alert on any deviation from pure-ftpd and root process contexts.
Track write operations to the Froxlor panel_admins table and correlate with subsequent administrator sign-ins.
Alert on privilege transitions where the www-data or PHP worker context spawns processes running as root shortly after Froxlor panel activity.

How to Mitigate CVE-2024-58383

Immediate Actions Required

Upgrade Froxlor to version 2.2.0 or later, which corrects the permissions on /etc/pure-ftpd/db/mysql.conf.
Manually restrict the file to chmod 0600 and set ownership to the pure-ftpd service account until the upgrade is applied.
Rotate the Froxlor MySQL user's password and reset all Froxlor administrator credentials and TOTP seeds.
Review the panel_admins table for unauthorized modifications and remove any unknown administrator accounts.

Patch Information

Froxlor 2.2.0 remediates the issue by generating /etc/pure-ftpd/db/mysql.conf with restrictive permissions. Refer to the GitHub Security Advisory GHSA-34qg-65m4-f23m for the fixed commit and release notes.

Workarounds

Apply chmod 600 /etc/pure-ftpd/db/mysql.conf and chown root:root (or the pure-ftpd runtime user) as an interim measure.
Tighten permissions on parent directories, for example chmod 750 /etc/pure-ftpd/db, to prevent enumeration by unprivileged local users.
Where feasible, migrate off pure-ftpd to an FTP backend not affected by this templated configuration generation.
Isolate hosted tenants so PHP/CGI workloads cannot read sensitive filesystem paths outside their document roots via open_basedir or systemd sandboxing.

bash

# Configuration example
chmod 600 /etc/pure-ftpd/db/mysql.conf
chown root:root /etc/pure-ftpd/db/mysql.conf
chmod 750 /etc/pure-ftpd/db