Description

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T13:17:15.150Z",
  "pubdate": "2026-09-14T13:17:15.150Z",
  "executiveSummary": "Froxlor versions up to and including 2.2.0-rc3 exhibit an insecure configuration file permission vulnerability that exposes sensitive database credentials. The issue stems from the generation of /etc/pure-ftpd/db/mysql.conf with insecure 0644 file permissions, making the file world-readable by design.\nThis vulnerability poses a critical risk to systems utilizing pure-ftpd, as it permits any unprivileged local user—including those restricted by virtual hosting environments—to access the Froxlor SQL user's plaintext credentials. An attacker gaining this information can pivot to full administrative compromise of the Froxlor control panel by modifying authentication parameters, such as administrator password hashes and TOTP seeds. Ultimately, this breach facilitates privilege escalation to the root level. The vulnerability is highly exploitable on systems with default directory access controls, such as Debian 12, where parent directory permissions do not prevent traversal or read access to the sensitive configuration file.",
  "technicalDetails": "The root cause of this vulnerability is improper access control enforced during the automated generation of the Pure-FTPd configuration file. Specifically, the XML configuration templates located in 'lib/configfiles/' within the Froxlor source code explicitly set the file mode for '/etc/pure-ftpd/db/mysql.conf' to 0644. In a standard Unix/Linux environment, this mode grants read access to all users on the system, which is inherently insecure for files containing authentication secrets.\nThe vulnerability manifests because the configuration file contains the database username and plaintext password required for Froxlor to interface with its backend MySQL/MariaDB instance. On systems utilizing typical directory structures (e.g., Debian 12), the parent directories of the configuration file are world-readable, effectively bypassing any obscurity that might otherwise protect such files.\nThe attack flow proceeds as follows: 1) The attacker gains initial execution capabilities on the host system. This may be achieved through compromised virtual hosting accounts, malicious PHP/CGI script execution, or existing low-privileged shell access. 2) The attacker navigates to the known path '/etc/pure-ftpd/db/mysql.conf'. 3) Due to the 0644 permission settings, the attacker reads the database credentials. 4) The attacker connects to the underlying SQL database using the stolen credentials. 5) With direct database access, the attacker executes queries to modify the 'admin' table, specifically resetting the administrator's password hash and clearing or altering the TOTP seed. 6) The attacker logs into the Froxlor administrative dashboard using the modified credentials. 7) Finally, the attacker leverages the administrative interface to execute system-level commands, achieving full root-level compromise of the server.\nThe scope of this vulnerability is restricted to Froxlor instances that have enabled and configured the pure-ftpd service. Because this is a static configuration error, no remote network exposure is required to initiate the theft of credentials; however, the ability to execute code locally is a prerequisite. The vulnerability is present in all versions of Froxlor prior to 2.2.0, including 2.2.0-rc3."
}