Vulnerability in Froxlor: Insecure Permissions on MySQL Configuration File
Summary
GHSA-34qg-65m4-f23m: Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains. Affects froxlor/froxlor versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Froxlor is an open-source server management panel that allows users to manage web hosting services. It provides a user-friendly interface for managing various aspects of server administration, including domain management, email accounts, and FTP services. One of the key features of Froxlor is its integration with pure-ftpd, a popular FTP server software. However, a vulnerability has been discovered in Froxlor's handling of the MySQL configuration file used by pure-ftpd.
Vulnerability Detail
The vulnerability arises from the insecure permissions set on the MySQL configuration file, 'mysql.conf', located in the '/etc/pure-ftpd/db/' directory. Despite containing sensitive information such as the '<SQL_UNPRIVILEGED_PASSWORD>', the file is set to 'chmod 644', making it world-readable. This means that any user with access to the system can easily obtain the credentials required to access the Froxlor MySQL database. This vulnerability affects Froxlor instances configured to use pure-ftpd.
How To Fix
Minimum fixed version
2.2.0
This is the first release that contains the fix.
composer require froxlor/froxlor:2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify the permissions of the 'mysql.conf' file to restrict access. The recommended permissions are 'chmod 600', which limits read and write access to the owner only. This can be achieved by running the following command:
chmod 600 /etc/pure-ftpd/db/mysql.conf
Conclusion
The vulnerability in Froxlor's handling of the MySQL configuration file poses a significant security risk to systems running Froxlor with pure-ftpd. By allowing unauthorized access to sensitive credentials, an attacker can potentially gain administrative or root privileges on the server. It is crucial to update Froxlor to the latest version and ensure proper permissions are set on the 'mysql.conf' file to mitigate this vulnerability.
See every vulnerability recorded for froxlor/froxlor →
FAQ
The vulnerability allows any unprivileged user with command/code execution access to the system to obtain the credentials for the Froxlor MySQL database. This includes virtual users without SSH access who can upload their own scripts or CGIs. With access to the database, an attacker can potentially escalate their privileges and gain administrative or even root access to the system.
An attacker can use the obtained database credentials to extract or change a Froxlor admin's password hash and TOTP seed value. By logging into Froxlor as the admin, the attacker can then modify critical settings, such as the 'Cron-daemon reload command', to execute arbitrary commands on the system. This can lead to further compromise of the server, including unauthorized access via SSH.
It is highly recommended to implement passwordless Unix socket authentication for database connections. This eliminates the need for database passwords and provides a more secure authentication mechanism. Additionally, regular monitoring and auditing of server logs can help detect any suspicious activities related to Froxlor or the MySQL database.
Yes, Froxlor versions up to and including 2.2.0-rc3 are known to be affected by this vulnerability. It is crucial to update to version 2.2.0 or later to mitigate the risk.
The Froxlor documentation provides detailed guidance on securing the installation, including best practices for server hardening, securing database connections, and configuring access controls. It is recommended to review the official documentation and follow the recommended security measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
