Description

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:58.077Z",
  "pubdate": "2026-09-26T14:16:58.077Z",
  "executiveSummary": "Froxlor versions prior to 2.3.12 are susceptible to a credential disclosure vulnerability within the API infrastructure.\nThe vulnerability resides in the DirProtections.listing API command, which improperly exposes sensitive password hashes associated with protected directory users.\nThe flaw allows an authenticated API user to retrieve bcrypt-hashed credentials stored in htpasswd files, significantly increasing the risk of unauthorized access through offline brute-force or dictionary-based cracking attacks.\nThis exposure facilitates the potential compromise of downstream protected resources and aids in credential harvesting, particularly where users practice password reuse across multiple services.\nExploitation requires an attacker to possess valid API credentials, meaning the attack vector is restricted to authenticated sessions. However, the impact is severe, as it leads to the unauthorized extraction of cryptographic material that should remain inaccessible to the API layer.\nOrganizations using affected versions of Froxlor are at risk of lateral movement and service degradation should the retrieved hashes be successfully reversed.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control or data filtering implementation within the DirProtections.listing API command in Froxlor versions prior to 2.3.12.\nSpecifically, the API endpoint is designed to provide administrative or user-level information regarding directory protections; however, the response payload incorrectly includes the raw or hashed password content typically stored in htpasswd files for directory-level authentication.\nWhen a request is submitted to the DirProtections.listing function, the application backend retrieves configuration data from the filesystem or internal database. Due to a failure in the API response serialization logic, the system includes the stored bcrypt password hashes in the returned JSON object.\nThe attack flow proceeds as follows: First, the attacker must have valid access to the Froxlor API, requiring a legitimate authentication token or API key. Second, the attacker invokes the DirProtections.listing command via a standard HTTP request to the Froxlor API endpoint. Third, the server processes the request and improperly parses the directory protection data, serializing the sensitive htpasswd credentials into the response body.\nUpon receiving the response, the attacker parses the JSON output to extract the bcrypt hashes for the protected directory users. These hashes can then be exported for offline analysis using tools such as Hashcat or John the Ripper.\nBecause the hashes are bcrypt-based, while computationally expensive to reverse, they are vulnerable to automated cracking techniques if the underlying passwords are not sufficiently complex or are known from other data breaches.\nThe vulnerable component is the API controller responsible for handling directory protection operations. The lack of proper data sanitization ensures that even privileged users who might not require direct visibility into password hashes are inadvertently granted access to this sensitive information.\nThe post-exploitation impact includes the potential decryption of user passwords, which grants the attacker unauthorized access to protected web directories. Furthermore, if users utilize the same password for their Froxlor account or other organizational services, this vulnerability serves as a primary vector for credential stuffing and broader system compromise."
}