CVE-2024-48651

HIGHNuclei

ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2024-48651 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 29, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

proftpd

Browse proftpd / proftpd

Default status: unknown

CVE ListThrough 1.3.8baffected
Before cec01ccaffected

Nuclei templates

1
ProjectDiscoveryHIGHProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sqlCVSS 7.5

ProFTPD versions through 1.3.8b (before commit cec01cc) contain a vulnerability in the mod_sql module due to improper handling of supplemental groups. This flaw allows authenticated users without explicitly assigned supplemental groups to inherit root group privileges (GID 0), potentially granting unauthorized access to sensitive system resources.

Impact

Authenticated users can exploit improper supplemental group handling in mod_sql to inherit root group privileges (GID 0), potentially accessing sensitive files and system resources restricted to the root group.

Remediation

Upgrade to ProFTPD version newer than 1.3.8b (after commit cec01cc) that properly handles supplemental groups in the mod_sql module.

WeaknessesCWE-863
Authorspussycat0x
Template tagscvecve2024networkftpproftpdtcppassivepriv-escvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Shodan: product:"ProFTPD"
https://github.com/proftpd/proftpd/commit/cec01cc0a2523453e5da5a486bc6d977c3768db1 https://github.com/proftpd/proftpd/issues/1830

Source: ProjectDiscovery

References

4