GHSA-5rw4-4665-cvwf: Input Validation
Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.
The stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:
www\t60\tIN\tA\t6.6.6.6 ;\n@
with type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\Dns\DnsEntry::toString() sink renders it as:
www 60 in a 6.6.6.6 ; @ 18000 IN A 127.0.0.1
BIND accepts the generated zone file:
named-checkzone example.com froxlordnsrecordinjected.zone zone example.com/IN: loaded serial 2026060501 OK
named-compilezone -D confirms both records are parsed as real DNS RRs:
example.com. 18000 IN A 127.0.0.1 www.example.com. 60 IN A 6.6.6.6 zone example.com/IN: loaded serial 2026060501 OK
Affected code in 2.3.7: - lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params. - lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection. - lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only. - lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domaindnsentries. - lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry. - lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.
There is also a related type-field variant because type is not allowlisted and domaindnsentries.type is varchar(10). The value NS\tns.\n@\tA renders one submitted entry as multiple zone-file records.
Impact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.
Suggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, , .label, service.proto, dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.
Attribution: Yaohui Wang.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/froxlor/froxlorto a version that resolves this vulnerability.Fixed in 2.3.8 - Upgrade
Upgrade
Froxlor 2.3.7to a version that resolves this vulnerability.Fixed in 2.3.7 - Configuration
Implement defense-in-depth in DnsEntry or the zone-file serializer so CR/LF/control characters (and tab characters) and semicolon comment delimiters cannot be rendered into generated BIND zone-file lines. Specifically validate API params record and type before they are persisted and before __toString() concatenates record/type/content into a zone line; reject any record/type containing CR, LF, HTAB, control characters, spaces, or semicolon (;). Also validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors.
Froxlor DNS zone record/type handling (Froxlor\Dns\DnsEntry::__toString() / DNS serializer) DNS record and type input validation = Reject CR (\r), LF (\n), HTAB (\t), semicolon (;), and other control characters in API parameters record and type; only allow intended DNS owner/name patterns for record including: @, *, *.label, _service._proto, _dmarc, and DKIM selectors.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Froxlor customer account that has permission to manage DNS zones. The attacker can reach the vulnerable API command over the network and does not need user interaction.
Which version information is available?
The vulnerable behavior is documented in Froxlor 2.3.7. The available release reference identifies 2.3.8, but the supplied data does not state a broader affected-version range.
How can administrators check for possible exploitation?
An administrator can inspect DNS records created through DomainZones.add for unexpected control characters, tab-delimited fields, semicolons, or injected records. Generated BIND zone files can also be checked with named-checkzone or named-compilezone to identify records that were parsed beyond the intended entry.