{"id":"GHSA-5rw4-4665-cvwf","summary":"Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields","details":"Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.\n\nThe stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:\n\nwww\\t60\\tIN\\tA\\t6.6.6.6 ;\\n@\n\nwith type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\\Dns\\DnsEntry::__toString() sink renders it as:\n\nwww    60    in    a    6.6.6.6 ;\n@      18000 IN    A    127.0.0.1\n\nBIND accepts the generated zone file:\n\nnamed-checkzone example.com froxlor_dns_record_injected.zone\nzone example.com/IN: loaded serial 2026060501\nOK\n\nnamed-compilezone -D confirms both records are parsed as real DNS RRs:\n\nexample.com.       18000 IN A 127.0.0.1\nwww.example.com.      60 IN A 6.6.6.6\nzone example.com/IN: loaded serial 2026060501\nOK\n\nAffected code in 2.3.7:\n- lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.\n- lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.\n- lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.\n- lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.\n- lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.\n- lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.\n\nThere is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\\tns.\\n@\\tA renders one submitted entry as multiple zone-file records.\n\nImpact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.\n\nSuggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.\n\nAttribution: Yaohui Wang.","aliases":["CVE-2026-54543"],"modified":"2026-08-18T21:11:20.910742Z","published":"2026-08-18T20:48:04Z","database_specific":{"github_reviewed_at":"2026-08-18T20:48:04Z","nvd_published_at":null,"cwe_ids":["CWE-20","CWE-74"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf"},{"type":"WEB","url":"https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a"},{"type":"PACKAGE","url":"https://github.com/froxlor/froxlor"},{"type":"WEB","url":"https://github.com/froxlor/froxlor/releases/tag/2.3.8"}],"affected":[{"package":{"name":"froxlor/froxlor","ecosystem":"Packagist","purl":"pkg:composer/froxlor/froxlor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8"}]}],"versions":["0.10.0","0.10.0-rc1","0.10.0-rc2","0.10.1","0.10.10","0.10.11","0.10.12","0.10.13","0.10.14","0.10.15","0.10.16","0.10.17","0.10.18","0.10.19","0.10.2","0.10.20","0.10.21","0.10.22","0.10.23","0.10.23.1","0.10.24","0.10.25","0.10.26","0.10.27","0.10.28","0.10.29","0.10.29.1","0.10.3","0.10.30","0.10.31","0.10.32","0.10.33","0.10.34","0.10.34.1","0.10.35","0.10.35.1","0.10.36","0.10.37","0.10.38","0.10.38.1","0.10.38.2","0.10.38.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-beta1","2.1.0-beta2","2.1.0-rc1","2.1.0-rc2","2.1.0-rc3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-rc1","2.2.0-rc2","2.2.0-rc3","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-5rw4-4665-cvwf/GHSA-5rw4-4665-cvwf.json","last_known_affected_version_range":"\u003c= 2.3.7"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}]}