Listen to this Post
CVE-2026-54347 is a stored Cross-Site Scripting (XSS) vulnerability identified in Froxlor, an open-source server administration software. The flaw resides in the DNS editor functionality, specifically within the handling of TXT record content. An authenticated user with DNS editor access, typically a customer, can inject arbitrary JavaScript into a TXT record.
The vulnerability is the result of a chain of three insecure coding practices within the Froxlor codebase. First, the input validation in `lib/Froxlor/Api/Commands/DomainZones.php` fails to strip HTML special characters like `<` and >. Second, the display callback in `lib/Froxlor/UI/Callbacks/Text.php` returns the content without HTML escaping. Finally, the Twig template `templates/Froxlor/table/table.html.twig` renders this callback output using the `|raw` filter, which prevents automatic escaping. This allows the injected JavaScript to be stored and later executed in the context of an administrator’s browser session when they view the DNS configuration of the affected domain.
The attack requires minimal privileges and no user interaction beyond the administrator navigating to the DNS editor page. The impact is critical, as it can lead to complete admin account takeover, credential theft, and potentially full server compromise. The issue is fixed in Froxlor version 2.3.8.
DailyCVE Form:
Platform: Froxlor
Version: < 2.3.8
Vulnerability : Stored XSS
Severity: High (CVSS 8.7)
date: 2026-08-18
Prediction: 2026-08-18 (2.3.8)
What Undercode Say:
The exploitation of this vulnerability can be confirmed using the following bash command to verify the presence of the unescaped payload.
T=$(curl -sc /tmp/c http://TARGET/index.php | grep -oP 'csrf-token" content="\K[^"]+') && \ curl -sc /tmp/c -b /tmp/c http://TARGET/index.php \ -d "loginname=admin&password=PASS&dologin=1&send=send&csrf_token=$T" -o /dev/null && \ curl -sb /tmp/c "http://TARGET/admin_domains.php?page=domaindnseditor&domain_id=ID" \ | grep -o '<img src=x[^>]>'
Exploit: (Educational Purposes!)
An attacker with a customer account and DNS editor access can exploit this vulnerability by following these steps:
1. Navigate to the DNS editor for any domain they control.
2. Add a new TXT record with the following values:
Record: `@`
Type: `TXT`
Content: `
`
- Once an administrator views the DNS configuration for that domain, the injected JavaScript will execute automatically in their browser.
A real-world attacker would replace the benign `alert()` function with a malicious script to silently exfiltrate the admin’s session cookie, enabling them to take over the account.
Protection:
To protect against CVE-2026-54347, the following actions are recommended:
Update Froxlor: The most effective mitigation is to upgrade to Froxlor version 2.3.8 or later, which contains the official fix.
Apply Fix Options: If updating is not immediately possible, apply one of the following code fixes:
Option A (Recommended): Remove the `|raw` filter from the table template (templates/Froxlor/table/table.html.twig:57).
Option B: Escape output in the callback by adding `htmlspecialchars()` in lib/Froxlor/UI/Callbacks/Text.php:95.
Option C: Sanitize input by adding `htmlspecialchars()` in lib/Froxlor/Api/Commands/DomainZones.php.
Update CSP Header: Remove the `’unsafe-inline’` and `’unsafe-eval’` directives from the Content-Security-Policy header in lib/Froxlor/UI/Panel/UI.php:140.
Impact
Type: Stored Cross-Site Scripting (Stored XSS).
Affected Parties: Any Froxlor installation with DNS editor functionality enabled. The attack requires a low-privilege customer account, while the victim is any administrator who views the affected domain’s DNS configuration.
Consequences: Successful exploitation allows an attacker to execute arbitrary JavaScript in an administrator’s browser. This can lead to:
Admin Account Takeover: Exfiltration of the admin session cookie allows the attacker to hijack the session and perform privileged actions.
Credential Theft: The attacker could steal admin credentials or other sensitive information.
Server Compromise: Through Froxlor’s system configuration interface, an attacker with admin access could potentially execute arbitrary commands on the underlying server.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
