CVE-2026-100719

Executive Summary

CVE-2026-100719 is a credential disclosure vulnerability in Froxlor versions before 2.3.12, where the DirProtections.listing API command returns htpasswd password hashes for protected-directory users. Any authenticated API user can retrieve bcrypt password hashes, enabling offline cracking and potential credential reuse attacks. The vulnerability carries a CVSS score of 6.5 (Medium) with high confidentiality impact, and no public proof-of-concept, exploit code, or Nuclei template is currently available.

Technical Analysis

Froxlor is a web-based server management control panel used to administer web hosting environments, including domains, email, FTP accounts, and directory-level access controls. Its API exposes programmatic access to administrative functions, and authentication is required to invoke commands within that API.

The core defect in CVE-2026-100719 resides in the DirProtections.listing API command. Directory protection in hosting panels typically relies on HTTP Basic Authentication backed by .htpasswd files. Each entry in an htpasswd file stores a username mapped to a password hash. In Froxlor versions before 2.3.12, invoking the DirProtections.listing command returns those stored htpasswd password hashes to the caller, rather than restricting output to non-sensitive metadata such as directory paths, enabled/disabled state, or usernames.

This constitutes a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) weakness. The description specifically states that the exposed artifact is the bcrypt password hash. Bcrypt is a deliberately slow, adaptive hashing algorithm, which raises the cost of brute-force and dictionary attacks, but it does not render offline cracking infeasible. Attackers who obtain the hash can attempt cracking at their own pace without interacting with the live server, thereby avoiding rate limiting, lockout, and monitoring on the authentication endpoint.

From a privilege perspective, the flaw is a privilege boundary violation. Directory protection credentials are intended to be scoped to HTTP Basic Authentication on specific protected paths. The API endpoint, however, requires only an authenticated API session and returns the underlying secret material in a reusable, crackable form. Thus, a low-privileged authenticated API user gains access to credentials that belong to other principals (protected-directory users), violating the intended separation of privileges.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects: network exploitable (AV:N), low attack complexity (AC:L), requires low privileges (PR:L, i.e., an authenticated API session), no user interaction (UI:N), scope unchanged (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N). The exposure of reusable credential material is the direct cause of the high confidentiality rating.

No public proof-of-concept, exploit code, or Nuclei template has been observed for this CVE. The attack mechanics below are inferred strictly from the vulnerability class and the behavior described in the NVD entry; no specific request payloads, internal function names, or file paths beyond those in the description are asserted.

Exploitation Scenarios

The following attack chain is derived from the vulnerability class and the NVD description. No public PoC exists; steps are presented at the level of the vulnerability class.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-reachable Froxlor instance, typically by locating the control panel login page or its API surface. The Shodan dorks above can be used to enumerate exposed Froxlor deployments. The attacker then needs to determine whether the instance is running a version earlier than 2.3.12, as only those versions are affected.

2. Access acquisition (prerequisite). Because the CVSS vector specifies PR:L, the attacker must already possess a valid authenticated API session. This could be a legitimate low-privileged API credential, a credential obtained through phishing or credential stuffing, or a session hijacked from another user. Without an authenticated session, the vulnerable command cannot be invoked.

3. Triggering the specific flaw. Using the authenticated API session, the attacker invokes the DirProtections.listing API command. Per the NVD description, this command returns htpasswd password hashes. The attacker collects the returned bcrypt hashes, which correspond to protected-directory users. This step is low-complexity and requires no user interaction, matching the vector's AC:L and UI:N.

4. Payload / execution method. There is no memory-corruption or remote-code-execution payload associated with this class. The "payload" is the API call itself; the sensitive output is the bcrypt hash list. The attacker need not craft an exploit — the vulnerable behavior is invoked through normal use of the API command.

5. Offline cracking and post-exploitation. The attacker exports the bcrypt hashes to their own cracking infrastructure and runs dictionary, rule-based, or brute-force attacks against them using GPU-accelerated tooling. Any cracked plaintext — or, more commonly, evidence that a protected-directory password equals a reused account password elsewhere — provides a foothold for lateral movement. Because users frequently reuse passwords across hosting panel accounts, FTP, email, SSH, and third-party services, a single cracked hash can yield access well beyond the protected directory. Successful reuse enables privilege escalation within the panel and potentially compromise of hosted sites or server-level access.

6. Blast radius extension. If the Froxlor instance is multi-tenant, hashes from multiple customers may be exposed in a single API call, multiplying the impact. An attacker may also passively retain the hashes for future cracking as computing resources become available, since the hash material does not expire with the API session.

Impact Assessment

The CVSS base score of 6.5 is Medium. The subscores that drive it are:

• Confidentiality: High (C:H) — bcrypt password hashes are secret material whose disclosure materially weakens authentication.
• Integrity: None (I:N) — the command does not modify data.
• Availability: None (A:N) — no service disruption.
• Attack Vector: Network (AV:N); Attack Complexity: Low (AC:L); Privileges Required: Low (PR:L); User Interaction: None (UI:N); Scope: Unchanged (S:U).

Business impact includes: (a) exposure of authentication secrets for all users of protected directories on an affected Froxlor instance; (b) downstream credential reuse risk affecting FTP, email, panel accounts, and external services; (c) regulatory and compliance exposure given that credentials are personal and potentially customer-owned data (e.g., GDPR-style breach notification considerations where applicable); and (d) erosion of trust in the hosting provider's isolation guarantees between API-level and directory-level privileges. Because exploitation requires only an authenticated API session and returns results in a single call, attacker cost is low and the action is easily repeated or automated across tenants.

Detection Guidance

Detection should focus on monitoring API invocations of the DirProtections.listing command, anomalous authenticated API session behavior, and abnormal authentication patterns on protected paths.

Sigma Rule

title: Froxlor DirProtections.listing Credential Disclosure Attempt
id: 8f2c1e7a-3b4d-4e9a-9c1f-2a7d6e5b0c33
status: experimental
description: Detects API invocations of the Froxlor DirProtections.listing command that may disclose htpasswd password hashes (CVE-2026-100719).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100719
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'DirProtections.listing'
      - 'DirProtections%2Elsting'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate administrative API usage by authorized operators
level: medium
tags:
  - attack.t1552
  - cve.2026.100719

YARA Rule

rule CVE_2026_100719_Froxlor_DirProtections
{
    meta:
        description = "Detects references to the vulnerable Froxlor DirProtections.listing API command associated with CVE-2026-100719"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100719"
        date = "2026-01-01"
        cve = "CVE-2026-100719"

    strings:
        $cmd = "DirProtections.listing" ascii wide nocase
        $htp = "htpasswd" ascii wide nocase
        $bcr = "bcrypt" ascii wide nocase
        $api = "api.php" ascii wide nocase

    condition:
        $cmd and any of ($htp, $bcr) and $api
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100719 Froxlor DirProtections.listing Credential Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"DirProtections.listing"; nocase; http.uri; content:"api"; nocase; classtype:attempted-recon; reference:cve,2026-100719; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100719; sid:2026100719; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ network where event.category == "network" and
      url.query contains "DirProtections.listing" and
      http.request.method in ("GET", "POST") ]
  [ authentication where event.action == "user_authentication" and
      event.outcome == "success" and
      source.ip == user.source.ip ]

Splunk SPL Query

index=web OR index=proxy
| eval uri_lower = lower(uri)
| where match(uri_lower, "dirprotections\.listing") OR match(uri_lower, "froxlor") AND match(uri_lower, "dirprotection")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,froxlor,cve-2026-100719">
  <rule id="2026107" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>DirProtections.listing</url>
    <description>CVE-2026-100719: Froxlor DirProtections.listing API command invoked - possible htpasswd hash disclosure</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_100719,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (apply while unpatched):

   • Review the privilege model of all Froxlor API accounts and remove or disable API users that do not strictly require access, reducing the pool of principals that can invoke DirProtections.listing.
   • Restrict network reachability of the Froxlor API to trusted management networks via firewall rules or a reverse proxy allowlist; do not expose the API to the general internet.
   • Enforce strong, unique passwords for protected-directory users and for all panel/API accounts, and rotate any credentials that were used for protected directories in case the hashes were already retrieved. Assume prior compromise if an affected version was exposed to many users.
   • Enable detailed API and web-server logging (authentication events plus request URIs), and alert on any invocation of the DirProtections.listing command.
   • Monitor for cracked-credential reuse by watching for authentication from unexpected source IPs or User-Agent values against protected paths and adjacent services.

2. Patch / upgrade steps:

   • Upgrade Froxlor to version 2.3.12 or later, which is the version boundary identified in the NVD description as the fix point. Before upgrading, take a full configuration and data backup and record the current version.
   • After upgrading, verify that the version reported by the panel is 2.3.12 or later, and confirm by testing (in a controlled, authorized manner with a low-privileged API user) that the DirProtections.listing command no longer returns password hashes.
   • Rotate all protected-directory credentials and any potentially reused passwords after remediation, since exposure prior to patching cannot be undone.

3. Long-term hardening:

   • Adopt a least-privilege API design principle: listing operations should return metadata only, never secrets; audit every API command for fields that carry credentials, tokens, or hashes.
   • Use a secrets-management approach so that password hashes are not directly retrievable through administrative interfaces; where feasible, protect directory authentication with an external identity provider or token-based auth instead of locally stored htpasswd files.
   • Implement logging, retention, and alerting on all API commands that return credential-adjacent data, and periodically review the Froxlor project's release notes and security advisories for follow-up fixes.
   • Deploy MFA where the hosting platform supports it for administrative access, and monitor for credential-stuffing activity against panel and protected-directory endpoints.

References

1. NVD — CVE-2026-100719: https://nvd.nist.gov/vuln/detail/CVE-2026-100719
2. Froxlor project repository and changelog (verify release 2.3.12): https://github.com/Froxlor/Froxlor/releases
3. Froxlor official documentation and API reference: https://froxlor.org/
4. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100719 is NOT listed as of this report; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public Proof-of-Concept, exploit code, or Nuclei template was identified for CVE-2026-100719 at the time of writing. No threat-actor campaign or in-the-wild exploitation evidence is available from the provided data. The vulnerability is not listed in CISA KEV.