CVE-2026-54543: Froxlor/froxlor Froxlor DomainZones.add Allows DNS Zone-file Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5rw4-4665-cvwf",
  "modified" : "2026-08-18T20:48:04Z",
  "published" : "2026-08-18T20:48:04Z",
  "aliases" : [ "CVE-2026-54543" ],
  "summary" : "Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields",
  "details" : "Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.\n\nThe stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:\n\nwww\\t60\\tIN\\tA\\t6.6.6.6 ;\\n@\n\nwith type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\\Dns\\DnsEntry::__toString() sink renders it as:\n\nwww    60    in    a    6.6.6.6 ;\n@      18000 IN    A    127.0.0.1\n\nBIND accepts the generated zone file:\n\nnamed-checkzone example.com froxlor_dns_record_injected.zone\nzone example.com/IN: loaded serial 2026060501\nOK\n\nnamed-compilezone -D confirms both records are parsed as real DNS RRs:\n\nexample.com.       18000 IN A 127.0.0.1\nwww.example.com.      60 IN A 6.6.6.6\nzone example.com/IN: loaded serial 2026060501\nOK\n\nAffected code in 2.3.7:\n- lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.\n- lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.\n- lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.\n- lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.\n- lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.\n- lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.\n\nThere is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\\tns.\\n@\\tA renders one submitted entry as multiple zone-file records.\n\nImpact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.\n\nSuggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.\n\nAttribution: Yaohui Wang.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "froxlor/froxlor"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.8"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.3.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/froxlor/froxlor"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/froxlor/froxlor/releases/tag/2.3.8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-74" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-18T20:48:04Z",
    "nvd_published_at" : null
  }
}