CVE-2024-58383

Executive Summary

CVE-2024-58383 is a local credential-disclosure flaw in Froxlor (a web-based server management/control panel) that affects versions before 2.2.0, up to and including 2.2.0-rc3, specifically on instances configured to use pure-ftpd. The XML configuration templates shipped in lib/configfiles/ cause /etc/pure-ftpd/db/mysql.conf to be written with file mode 0644 despite containing the Froxlor SQL user's password, and on systems with world-readable parent directories (the default on Debian 12) any unprivileged local user — including non-SSH virtual users who can upload PHP/CGI scripts — can read the file and recover the database credentials. Those credentials can then be abused to alter an administrator's password hash and TOTP seed, leading to administrative login and ultimately root-level compromise.

Technical Analysis

This is a CWE-732: Incorrect Permission Assignment for a Critical Resource vulnerability. The defect is not a code-execution bug or an injection flaw; it is a misconfiguration generated by Froxlor as a normal part of its provisioning workflow.

Froxlor generates configuration files for the services it manages from XML templates located in the lib/configfiles/ directory tree. One of these templates governs the pure-ftpd MySQL-backed authentication database. When Froxlor renders this template, it writes the resulting file to:

/etc/pure-ftpd/db/mysql.conf

That file necessarily contains credentials — specifically the Froxlor SQL user's password — because pure-ftpd must authenticate against the same MySQL/MariaDB instance that Froxlor uses to store its data.

The vulnerability arises because the generated file is created with mode 0644 (owner read/write; group and world read-only). A mode of 0644 on a file that contains a plaintext database password means:

1. Any process or user on the host can read the file, provided every directory component in the path is traversable (i.e., has the execute bit set for the accessing user).
2. On Debian 12 defaults — as explicitly called out in the NVD description — the parent directories are world readable, so the traversal precondition is satisfied.

The result is a classic confidentiality failure: secrets that should be restricted to the owner (and perhaps a service group) are exposed to all local principals.

There is no remote network attack surface in the traditional sense. The CVSS vector confirms this: AV:L (Local), AC:L (Low complexity), PR:L (Low privileges required), UI:N (no user interaction). The attacker must already possess the ability to execute commands or code on the host. Crucially, the NVD description notes that this population includes virtual users without SSH access who can upload PHP/CGI scripts — i.e., a customer or tenant on a shared Froxlor-managed host can reach the file via a script they are legitimately allowed to upload and execute.

The scope is limited: only instances configured to use pure-ftpd are affected. Froxlor instances using other FTP backends (or no FTP service at all) do not generate this file and are not exposed by this specific defect.

Once the SQL password is known, the attacker does not need an additional memory-corruption or injection primitive — the credentials grant direct database access. From there, the NVD description states the credentials "can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges." The database is the trusted store for administrator authentication material, so possessing database write access effectively grants control over that authentication material.

Note on implementation detail: The NVD description does not enumerate the specific database tables, columns, or Froxlor PHP functions involved in the administrator credential manipulation. This report deliberately does not fabricate such details. What is confirmed is the credential file, its path, its mode, the XML template directory, the affected versions, and the downstream escalation path.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None; Nuclei template: NO). The chain below is inferred from the stated vulnerability class and the NVD description, not from a published exploit.

1) Reconnaissance / target identification. The attacker needs a Froxlor instance that uses pure-ftpd, running a version before 2.2.0 (or 2.2.0-rc3 or earlier). Because the exposure is local, "reconnaissance" means the attacker already has a foothold on the host — for example, a customer with a provisioning account who can upload and run PHP or CGI scripts. The attacker confirms the target by checking for the presence and readability of /etc/pure-ftpd/db/mysql.conf and by confirming the Froxlor version (the NVD description and version scope give the boundary: < 2.2.0).

2) Triggering the flaw. There is no "trigger" in the active sense — the flaw is a state. Froxlor already generated the file with mode 0644 during provisioning. The attacker simply attempts to read it:

cat /etc/pure-ftpd/db/mysql.conf

(or the equivalent read from within an uploaded PHP/CGI script). On Debian 12 defaults, the parent directory permissions allow traversal, so the read succeeds without privilege escalation. The file yields the Froxlor SQL username and password.

3) Payload / execution. At the vulnerability-class level, this is a credential-disclosure-to-credential-abuse chain. No memory-corruption or shell payload is required at this stage. The attacker uses the recovered SQL credentials to connect to the database (e.g., via the mysql client or through a script) and gains read/write access to the tables Froxlor uses to store administrator authentication material. The NVD description states the attacker alters the administrator's password hash and TOTP seed — meaning both the password-based and second-factor checks can be subverted. The exact SQL syntax and table names are not specified in the source data and are not invented here.

4) Post-exploitation impact. With a modified password hash and TOTP seed, the attacker authenticates to the Froxlor admin panel as a legitimate administrator. From that position — and consistent with the NVD description's stated end state — the attacker can ultimately gain root privileges. The CVSS vector reflects the resulting impact: High confidentiality (C:H), High integrity (I:H), and Low availability (A:L) impact, all within the unchanged security scope (S:U).

Impact Assessment

• Confidentiality (High): The Froxlor SQL user's password is directly disclosed, along with whatever data that database account can read.
• Integrity (High): Database write access permits modification of administrator authentication material (password hash, TOTP seed), and through that, alteration of the managed server's configuration and ultimately the system.
• Availability (Low): The primary objective is credential abuse and privilege escalation; availability impact is a secondary consequence, consistent with the A:L subscore.
• Attack Vector (Local), Complexity (Low), Privileges Required (Low), User Interaction (None): the bar for exploitation is low once any code-execution foothold exists on the host.
• Blast radius: Limited to Froxlor instances configured to use pure-ftpd. On multi-tenant hosts — the deployment model Froxlor is designed for — a single low-privileged tenant (even one without SSH, using only uploaded PHP/CGI) can compromise the entire server, including root.
• Overall CVSS: 7.3 (High) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
• EPSS: 0.00102 (~1.0th percentile of exploited CVEs) — low predicted likelihood of exploitation in the wild at time of writing.
• CISA KEV: Not listed. No known in-the-wild exploitation evidence is provided.

Detection Guidance

Detection here is mainly host-based (file permission and access auditing), because the initial exposure leaves no network signature. The escalation step — a new database login using the Froxlor SQL user from an unexpected source, then authentication material being changed — does produce observable signals.

Sigma Rule

title: CVE-2024-58383 - World-Readable pure-ftpd MySQL Config (Froxlor)
id: 9c1f2a44-7b3e-4d21-9a55-cve202458383
status: experimental
description: Detects creation or permission state of /etc/pure-ftpd/db/mysql.conf with world-readable mode, indicating CVE-2024-58383 exposure in Froxlor with pure-ftpd.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-58383
author: valtersit.com Threat Intelligence
date: 2026/06/17
tags:
  - attack.t1552
  - cve.2024.58383
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|endswith: '/pure-ftpd/db/mysql.conf'
  selection_perm:
    - FileMode: '0644'
    - FileMode: '0645'  # readonly+read; overly permissive
  condition: selection_path and selection_perm
falsepositives:
  - Intentional audit runs that temporarily relax permissions
level: high

YARA Rule

rule CVE_2024_58383_Froxlor_PureFTPD_Config_Creds
{
    meta:
        author      = "valtersit.com Threat Intelligence"
        description = "Detects pure-ftpd MySQL config generated by vulnerable Froxlor (CVE-2024-58383) containing DB credentials"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2024-58383"
        date        = "2026-06-17"
        cve         = "CVE-2024-58383"

    strings:
        $hdr1 = "pure-ftpd" nocase
        $hdr2 = "mysql" nocase
        $kw1  = "MYSQLUser" nocase
        $kw2  = "MYSQLPassword" nocase
        $kw3  = "MYSQLHost" nocase
        $kw4  = "MYSQLDatabase" nocase

    condition:
        (uint16(0) == 0x2323 or true) and
        (($hdr1 or $hdr2) and 1 of ($kw*)) or
        (2 of ($kw*))
}

Suricata IDS Rule

Network signatures are indirect: they target the database access that follows the credential theft. This rule alerts on MySQL authentication traffic originating from a host that is not the Froxlor management host, as an indicator of stolen SQL creds being used.

alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 ( \
    msg:"CVE-2024-58383 Possible Froxlor SQL Credential Abuse - Remote MySQL Login"; \
    flow:to_server,established; \
    content:"|05 00 00 01|"; depth:4; offset:3; \
    reference:cve,2024-58383; \
    reference:url,nvd.nist.gov/vuln/detail/CVE-2024-58383; \
    classtype:attempted-admin; \
    sid:2024583830; rev:1; \
    metadata:created_at 2026_06_17, updated_at 2026_06_17; \
)

Note: MySQL handshake byte-level matching is inherently imprecise; pair this with host-level detection of mysql client invocations on Froxlor-managed hosts.

Elastic Detection

Detects reading of the sensitive config file followed by a new database or mysql client process launch by a non-root, non-service user.

sequence by host.id, user.name with maxspan=5m
  [ file where file.path == "/etc/pure-ftpd/db/mysql.conf" and event.action in ("opened","accessed") ]
  [ process where process.name in ("mysql","mariadb","mysqldump") ]

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
  ( "/etc/pure-ftpd/db/mysql.conf" OR "pure-ftpd/db/mysql.conf" )
  ( action=read OR name=open OR type=PATH )
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process, comm
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Alternative query for permission-state monitoring via periodic config audit:

index=linux ( "/etc/pure-ftpd/db/mysql.conf" )
| rex field=_raw "mode=(?<perm>\d{3,4})"
| where perm=="0644" OR perm=="0645" OR perm=="0646" OR perm=="0647"
| table _time host user process perm

Wazuh OSSEC Rule

<group name="froxlor,cve-2024-58383,credential_access,">
  <rule id="2024583" level="12">
    <if_sid>550</if_sid>
    <field name="file">/etc/pure-ftpd/db/mysql.conf</field>
    <description>CVE-2024-58383: Sensitive pure-ftpd MySQL config accessed or modified (Froxlor credential exposure).</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>

  <rule id="2024584" level="13">
    <if_group>syscheck</if_group>
    <field name="file">/etc/pure-ftpd/db/mysql.conf</field>
    <match>mode=0(?:64[4-7])</match>
    <description>CVE-2024-58383: pure-ftpd MySQL config has world-readable permissions.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED; no patch evidence found from any tracked source (no vendor advisory, no OSV entry, no workaround documented).

1) Immediate mitigations (do now, before a vendor fix is confirmed):

• Correct the file permissions. Restrict /etc/pure-ftpd/db/mysql.conf to owner-only access:

  chmod 0600 /etc/pure-ftpd/db/mysql.conf
  chown root:root /etc/pure-ftpd/db/mysql.conf
  

  On Debian 12, ensure no world-readable parent components grant traversal to this file. Verify the resulting mode with stat -c '%a %n' /etc/pure-ftpd/db/mysql.conf.
• Tighten parent directory permissions so the file path is not traversable by unprivileged users, since the NVD description identifies world-readable parent directories as the enabling condition on Debian 12 defaults.
• Remove the FTP foothold for the vulnerable pathway where feasible: if pure-ftpd is not strictly required, disable it. Only instances configured to use pure-ftpd are affected, so eliminating that backend removes the exposure.
• Restrict PHP/CGI execution for low-privileged virtual users so that unprivileged tenants cannot readily run scripts to read files.
• Rotate the Froxlor SQL user's password immediately if exposure cannot be precluded, and rotate administrator password hashes and TOTP seeds as a precaution (they are the stated escalation targets).
• Enable file-integrity monitoring (e.g., Wazuh/Syscheck, AIDE) on /etc/pure-ftpd/db/mysql.conf to catch future permission regressions.

2) Patch / upgrade:

• Upgrade Froxlor to 2.2.0 or later once the vendor release is validated. Note that no patch source is tracked here (Patch confidence 0/4) and the NVD description establishes only that versions before 2.2.0 (including 2.2.0-rc3) are affected. Confirm the fix against the official Froxlor release notes and changelog before relying on it — this report does not assert a specific upstream commit or advisory because none was provided.
• After upgrading, re-verify /etc/pure-ftpd/db/mysql.conf permissions and re-run the integrity check, since the defect is in the generated configuration templates under lib/configfiles/.

3) Long-term hardening:

• Apply a principle of least privilege across all Froxlor-generated service configs: any file containing a secret must be mode 0600 and owned by the service account.
• Standardize a deployment baseline (e.g., CIS Debian Linux benchmark) that enforces restrictive directory permissions on /etc/pure-ftpd/ and similar service config directories.
• Segment tenants: virtual users should be confined by filesystem and process sandboxing (e.g., per-user chroot, open_basedir, disable dangerous PHP/CGI functions) so that local code execution cannot reach management-plane secrets.
• Use unique, least-privileged database accounts per integration, so compromise of the FTP-integration credential does not grant broad administrative DB rights.
• Monitor and alert on changes to the Froxlor administrator authentication material (password hash, TOTP seed) as a high-fidelity signal of this and similar escalations.

References

1. NVD — CVE-2024-58383: https://nvd.nist.gov/vuln/detail/CVE-2024-58383
2. CWE-732 — Incorrect Permission Assignment for a Critical Resource: https://cwe.mitre.org/data/definitions/732.html
3. MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
4. Froxlor project (source and release channel for version 2.2.0 and later; verify fix status against official release notes): https://github.com/Froxlor/Froxlor
5. CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2024-58383 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No public PoC, exploit code, or Nuclei template was identified (POC_STATUS: None). EPSS is 0.00102 (~1.0th percentile), and the CVE is not in CISA KEV. There is no evidence of active exploitation or a named threat-actor campaign targeting CVE-2024-58383 at the time of writing. The attack chain described above is inferred from the vulnerability class and the NVD description.