Executive brief
Froxlor is a hosting control panel that manages web server configurations and directory protections. The DirProtections.listing API command incorrectly exposes bcrypt password hashes for protected-directory users to any authenticated API caller. An attacker with valid API credentials can retrieve these password hashes and attempt offline cracking to gain unauthorized access to protected directories or discover reused credentials across systems.
Technical details
The vulnerability is a sensitive information disclosure in the DirProtections API endpoint that fails to redact the password field containing htpasswd bcrypt hashes from serialized responses. An authenticated attacker with API credentials can call DirProtections.listing to retrieve password hashes, which can be cracked offline or used to identify credential reuse. The issue affects versions before 2.3.12 and is fixed by redacting credential fields from API serializers.
Affected products
- Froxlor Froxlor before 2.3.12
Timeline
- 2026-09-26: disclosed
- 2026-09-06: patched: patch version 2.3.12 released