{"id":"CVE-2026-54543","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-54543","summary":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","details":"Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.\n\nThe stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:\n\nwww\\t60\\tIN\\tA\\t6.6.6.6 ;\\n@\n\nwith type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\\Dns\\DnsEntry::__toString() sink renders it as:\n\nwww    60    in    a    6.6.6.6 ;\n@      18000 IN    A    127.0.0.1\n\nBIND accepts the generated zone file:\n\nnamed-checkzone example.com froxlor_dns_record_injected.zone\nzone example.com/IN: loaded serial 2026060501\nOK\n\nnamed-compilezone -D confirms both records are parsed as real DNS RRs:\n\nexample.com.       18000 IN A 127.0.0.1\nwww.example.com.      60 IN A 6.6.6.6\nzone example.com/IN: loaded serial 2026060501\nOK\n\nAffected code in 2.3.7:\n- lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.\n- lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.\n- lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.\n- lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.\n- lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.\n- lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.\n\nThere is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\\tns.\\n@\\tA renders one submitted entry as multiple zone-file records.\n\nImpact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.\n\nSuggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.\n\nAttribution: Yaohui Wang.","published":"2026-08-18T20:48:04Z","modified":"2026-08-18T21:00:07.858652609Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"froxlor/froxlor","fixedVersion":"2.3.8"}],"fix":{"url":"https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a","label":"froxlor/froxlor@a4f09f0"},"references":[{"type":"WEB","url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf"},{"type":"WEB","url":"https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a"},{"type":"PACKAGE","url":"https://github.com/froxlor/froxlor"},{"type":"WEB","url":"https://github.com/froxlor/froxlor/releases/tag/2.3.8"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T21:00:07.858652609Z"}}