CVE-2026-54543: Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before lib/Froxlor/Dns/DnsEntry.php serializes the values into a BIND zone file. An authenticated customer with DNS-zone permissions can place a crafted value in the record field, or use the related type-field variant, to create additional resource-record lines that bypass Froxlor's field-level validation. BIND accepts the injected records, allowing modification of DNS data and possible DNS availability impact within a zone the caller is authorized to manage. This issue is fixed in version 2.3.8.
Other sources
Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.
The stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:
www\t60\tIN\tA\t6.6.6.6 ;\n@
with type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\Dns\DnsEntry::toString() sink renders it as:
www 60 in a 6.6.6.6 ; @ 18000 IN A 127.0.0.1
BIND accepts the generated zone file:
named-checkzone example.com froxlordnsrecordinjected.zone zone example.com/IN: loaded serial 2026060501 OK
named-compilezone -D confirms both records are parsed as real DNS RRs:
example.com. 18000 IN A 127.0.0.1 www.example.com. 60 IN A 6.6.6.6 zone example.com/IN: loaded serial 2026060501 OK
Affected code in 2.3.7: - lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params. - lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection. - lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only. - lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domaindnsentries. - lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry. - lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.
There is also a related type-field variant because type is not allowlisted and domaindnsentries.type is varchar(10). The value NS\tns.\n@\tA renders one submitted entry as multiple zone-file records.
Impact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.
Suggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, , .label, service.proto, dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.
Attribution: Yaohui Wang.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/froxlor/froxlorto a version that resolves this vulnerability.Fixed in 2.3.8 - Upgrade
Upgrade
lib/Froxlor (Froxlor)to a version that resolves this vulnerability.Fixed in 2.3.8 - Configuration
In DnsEntry (or the DNS serializer that generates BIND zone file lines), implement defense-in-depth so that CR/LF/HTAB/control chars and semicolons cannot reach generated zone lines. Apply the same sanitization to both the record field and the related type-field variant.
Froxlor\Dns\DnsEntry (zone file serialization / __toString) zone line value sanitization for record/type/content = Reject any CR/LF/control characters (including tabs/HTAB) and semicolons in DNS zone-file fields (record and type) before serializing; allow only intended DNS owner-name cases (@, *, *.label, _service._proto, _dmarc, and DKIM selectors).
Event History
Frequently Asked Questions
Who can exploit this issue and what access is required?
Froxlor installations prior to 2.3.8 are affected where authenticated customers have permission to manage DNS zones. The impact is limited to zones the caller is authorized to manage.
What does an attacker need to do to exploit it?
An attacker must authenticate as a customer with DNS-zone permissions and submit crafted record or type values through the DomainZones.add API command. No user interaction is required.
What is the practical impact of a successful exploit?
Successful exploitation can add extra resource-record lines to a BIND zone file, modifying DNS data and potentially affecting DNS availability for the managed zone. BIND accepts the injected records.
What should administrators do if they cannot patch immediately?
Upgrade Froxlor to version 2.3.8, which fixes the issue. If upgrading is not immediately possible, restrict DNS-zone permissions to trusted users because exploitation requires an authenticated customer with those permissions.