CVE-2024-48651

What it actually does

Supplemental group inheritance in ProFTPD fails to incorporate groups from mod_sql, allowing authenticated users to access resources owned by GID 0.

Why it matters to the business

Attackers can read or interact with files and directories restricted to the root group, increasing the risk of sensitive data exposure on FTP servers that use SQL-based authentication.

How an attack unfolds

An attacker connects to a ProFTPD server using mod_sql for user authentication, logs in with valid credentials, and leverages the missing supplemental group population to inherit GID 0 access, bypassing intended authorization controls. The issue is weaponized in public exploits targeting the pre-cec01cc code.

How to fix it

Upgrade ProFTPD to the commit cec01cc0a2523453e5da5a486bc6d977c3768db1 or a later release that restores proper supplemental group handling from mod_sql.

How to confirm the fix worked

Confirm the running binary or source tree contains commit cec01cc0a2523453e5da5a486bc6d977c3768db1, then test that SQL-authenticated sessions receive the expected supplemental groups and cannot access GID 0 resources unintentionally.

Typical attack path

1. Identify a ProFTPD instance running a version prior to commit cec01cc that uses mod_sql
2. Authenticate to the server using SQL-stored credentials
3. Request access to files or directories whose permissions rely on GID 0 membership
4. Obtain unauthorized read access due to incorrect supplemental group inheritance

How to detect it

Review ProFTPD access logs and SQL authentication events for sessions that accessed paths normally restricted to GID 0; correlate with mod_sql query logs to identify unexpected group inheritance.

What your security team should do

• Apply the fixed commit immediately on all internet-facing ProFTPD deployments
• Audit mod_sql configurations for any reliance on GID 0 group membership
• Monitor EPSS trend and exploit availability for prioritization of remaining instances
• Replace mod_sql with alternative authentication modules if group inheritance cannot be validated