CVE-2026-100719 in Froxlor
Summary
by MITRE • 09/26/2026
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The Froxlor control panel software contains a critical information disclosure vulnerability within its DirProtections.listing Application Programming Interface command prior to version 2.3.12. This flaw allows authenticated API users to retrieve sensitive authentication data, specifically the htpasswd password hashes associated with protected directories managed by the system. The vulnerability stems from an improper access control mechanism that fails to restrict the exposure of cryptographic credentials during administrative operations. By exposing these hashes, the application inadvertently provides attackers with the raw material necessary for offline brute-force or dictionary attacks against user accounts secured through basic authentication mechanisms commonly used in web server configurations.
From a technical perspective, the DirProtections.listing endpoint is designed to list directory protection settings but erroneously includes the password hash field in its response payload without adequate sanitization or masking. This behavior violates fundamental principles of secure data handling where sensitive credentials should never be transmitted over an interface unless absolutely necessary and even then only in a masked format such as asterisks. The exposure of bcrypt hashes is particularly concerning because while bcrypt is computationally expensive to crack, it remains vulnerable to sophisticated offline attacks if the hash values are obtained by an adversary with sufficient computational resources or time. This flaw aligns directly with CWE-200 which categorizes Information Exposure under vulnerabilities where sensitive information is accessible without proper authorization controls.
The operational impact of this vulnerability extends beyond simple credential theft as it facilitates broader account compromise scenarios. Attackers who gain authenticated access to the Froxlor API can extract these hashes and employ tools like Hashcat or John the Ripper to attempt decryption. If users have reused passwords across multiple services, which is a common security anti-pattern, the successful cracking of one hash could lead to lateral movement into other systems such as email servers, database interfaces, or cloud management consoles. This scenario reflects aspects of ATT&CK technique T1078 Valid Accounts where adversaries leverage legitimate credentials obtained through information disclosure to maintain persistence and expand their foothold within an environment. The ability to perform offline cracking removes the rate-limiting protections typically present in online authentication attempts thereby increasing the probability of successful password recovery significantly.
Mitigation strategies must prioritize immediate patching as well as compensating controls for systems that cannot be updated immediately. Administrators should upgrade Froxlor to version 2.3.12 or later where this API endpoint has been corrected to exclude sensitive hash data from its output. For environments requiring extended downtime, it is advisable to restrict API access through network segmentation ensuring only trusted internal subnets can interact with the management interface. Additionally implementing strict role-based access control policies ensures that fewer users possess elevated privileges capable of invoking administrative commands like DirProtections.listing. Security monitoring should also be enhanced to detect unusual patterns in API usage such as repeated calls to sensitive endpoints which may indicate active exploitation attempts by malicious actors seeking to harvest credential material for subsequent attacks against organizational infrastructure.