GHSA-x6w6-2xwp-3jh6 is a high-severity (CVSS 8.8) CWE-74 vulnerability in froxlor/froxlor. A fix is available for froxlor/froxlor — see the affected versions and patch details below.
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-x6w6-2xwp-3jh6.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-x6w6-2xwp-3jh6 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 378,567 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
froxlor/froxlorReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs.
Affected Code
lib/Froxlor/Api/Commands/DomainZones.php, lines 213-214, 253-254, 290-291, 292-293:
} elseif ($type == 'LOC' && !empty($content)) {
$content = $content; // no validation
} ...
} elseif ($type == 'RP' && !empty($content)) {
$content = $content; // no validation
} ...
} elseif ($type == 'SSHFP' && !empty($content)) {
$content = $content; // no validation
} elseif ($type == 'TLSA' && !empty($content)) {
$content = $content; // no validation
}
There is even a TODO comment at line 148 acknowledging this gap:
// TODO regex validate content for invalid characters
The content is then written directly into the BIND zone file via DnsEntry::__toString() (line 83 of lib/Froxlor/Dns/DnsEntry.php):
return $this->record . "\t" . $this->ttl . "\t" . $this->class . "\t" . $this->type . "\t" ... . $_content . PHP_EOL;
And the zone file is written to disk in lib/Froxlor/Cron/Dns/Bind.php line 121:
fwrite($zonefile_handler, $zoneContent . $subzones);
PoC
As a customer with DNS management enabled and an API key, add a LOC record with injected BIND directives:
curl -s -u "API_KEY:API_SECRET" \
-H 'Content-Type: application/json' \
-d '{"command":"DomainZones.add","params":{"domainname":"example.com","type":"LOC","content":"0 0 0 N 0 0 0 E 0\n$INCLUDE /etc/passwd"}}' \
https://panel.example.com/api.php
Alternatively via the web UI, intercept the DNS editor form POST and set dns_content to 0 0 0 N 0 0 0 E 0\n$INCLUDE /etc/passwd and dns_type to LOC.
After the DNS rebuild cron runs, the resulting zone file at {bindconf_directory}/domains/example.com.zone will contain:
@ 18000 IN LOC 0 0 0 N 0 0 0 E 0
$INCLUDE /etc/passwd
BIND will process the $INCLUDE directive and attempt to parse /etc/passwd as zone data. While most lines will fail to parse as valid records, the file content is readable by the BIND process (running as bind/named user), confirming file existence and potentially leaking parseable lines as DNS records.
Impact
-
Information Disclosure: The
$INCLUDEdirective lets a customer read world-readable files on the server through the DNS subsystem. The zone content (including included files) is visible to the customer via theDomainZones.getAPI call or the DNS editor in the web UI. -
DNS Service Disruption: Malformed zone content can cause BIND to fail to load the zone, causing DNS outage for the affected domain. Injecting
$GENERATEdirectives could create massive record sets for amplification attacks. -
Zone Data Manipulation: Arbitrary DNS records can be injected by breaking out of the current record line with newlines, allowing the customer to create records that were not intended.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | froxlor/froxlor | all versions | 2.3.5composer require froxlor/froxlor:^2.3.5 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for froxlor/froxlor, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update froxlor/froxlor to 2.3.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x6w6-2xwp-3jh6 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-x6w6-2xwp-3jh6 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-x6w6-2xwp-3jh6. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-x6w6-2xwp-3jh6 in your dependencies?
O3 Security finds GHSA-x6w6-2xwp-3jh6 across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.