REDHAT-BUG-2531351: Medium severity Busybox Busybox vulnerability
A vulnerability exists in the BusyBox httpd applet's Basic Authentication password verification logic in networking/httpd.c. The code uses if (passwd[0] == '$' && isdigit(passwd[1])) to distinguish hashed passwords from plaintext. Yescrypt hashes begin with $y$, and because 'y' does not satisfy isdigit(), the detection logic fails. The code falls through to the plaintext strcmp branch, making the stored hash string itself the "password."
Supplying the literal hash string as the password results in HTTP 200, while the actual plaintext password is rejected with HTTP 401. Exploitation requires the attacker to first obtain the hash string from httpd.conf.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must obtain the Yescrypt hash string from httpd.conf. They can then submit that literal stored hash as the HTTP Basic Authentication password.
Are plaintext passwords accepted for affected Yescrypt-configured accounts?
No. For a password entry beginning with a Yescrypt hash, BusyBox httpd treats the hash as plaintext and compares it directly. The real plaintext password is rejected with HTTP 401, while the hash string is accepted and returns HTTP 200.