BusyBox httpd Basic Authentication Bypass via Yescrypt Hash

Executive Summary

BusyBox httpd incorrectly treats yescrypt password hashes as plaintext during Basic Authentication. This happens because the software fails to recognize yescrypt hashes ($y$) due to a flawed detection mechanism, causing it to accept the literal hash string as a valid password.

Useful 0 Not Useful 0

Detection Guidance

Check BusyBox httpd configuration files for yescrypt hashes in password fields. Look for entries starting with $y$ in httpd.conf or similar files. Test authentication by sending a request with the literal hash as the password and observe if the server accepts it (HTTP 200) while rejecting the correct plaintext password (HTTP 401).

Commands: grep -r "$y$" /etc/httpd.conf /etc/busybox-httpd/ 2>/dev/null; curl -u username:$y$hashedpassword http://target/

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to password-protected resources by supplying the yescrypt hash string as the password. This bypasses authentication, allowing access without knowing the actual password. The attack requires network access but no privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected systems may face compliance failures due to inadequate authentication controls.

Useful 0 Not Useful 0

Mitigation Strategies

Stop using BusyBox httpd for password-protected resources. If it must be used, replace yescrypt hashes ($y$) with SHA-512 hashes ($6$) in configuration files. Ensure no inline yescrypt hashes are present in httpd.conf or related files.

Useful 0 Not Useful 0