Hardfalcon

**Name of the Vulnerable Software and Affected Versions** Froxlor versions prior to 2.2.0 **Description** Instances configured to use pure-ftpd are affected by an issue where the XML configuration templates in `lib/configfiles/` generate the `/etc/pure-ftpd/db/mysql.conf` file with mode 0644. Because this file contains the Froxlor SQL user's password, any unprivileged local user capable of executing commands or code on the host—including virtual users who can upload PHP or CGI scripts—can read the file to obtain database credentials. This access can be further leveraged to modify an administrator's password hash and TOTP seed, allowing an attacker to log in as a Froxlor administrator and potentially gain root privileges on the system. **Recommendations** Update Froxlor to version 2.2.0 or later. As a mitigation measure, consider using passwordless unix socket authentication for database connections to remove the need for storing passwords in configuration files.