CVE-2026-54543: Froxlor DNS Injection Vulnerability

CVE-2026-54543 Overview

Froxlor, an open source server administration platform, contains a DNS record injection vulnerability in versions prior to 2.3.8. The DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types. The values flow into lib/Froxlor/Dns/DnsEntry.php, which serializes them into a BIND zone file. Authenticated customers with DNS-zone permissions can inject additional resource-record lines that bypass Froxlor's field-level validation. The issue is fixed in Froxlor 2.3.8.

Critical Impact
An authenticated customer with DNS-zone permissions can inject arbitrary BIND records, modifying DNS data and potentially impacting DNS availability within any zone the caller is authorized to manage.

Affected Products

Froxlor server administration software prior to version 2.3.8
Deployments serializing zone data into BIND zone files via DnsEntry.php
Multi-tenant hosting environments delegating DNS-zone permissions to customers

Discovery Timeline

2026-08-18 - CVE-2026-54543 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-54543

Vulnerability Analysis

The vulnerability is a DNS zone-file injection, classified under [CWE-74] (Improper Neutralization of Special Elements in Output). Froxlor's DomainZones.add API command accepts DNS record identifiers and record types from authenticated customers. Field-level validation checks the syntactic content of a single record but does not reject line-break characters, tabs, semicolons, or record types outside Froxlor's supported set.

When DnsEntry.php serializes these values into a BIND zone file, an attacker-supplied newline breaks out of the intended single-record context. BIND then parses the additional lines as legitimate resource records. The impact is confined to zones the authenticated caller is already authorized to manage, but within that zone the attacker can insert or overwrite records to modify DNS resolution or destabilize zone loading.

Root Cause

The root cause is missing output-context sanitization. Input validation was oriented toward the DNS record name and did not consider the zone-file serialization layer. Because BIND treats each newline as a new record, any control character passed through into the zone file becomes an injection primitive. The patched code enforces a printable ASCII allowlist on record and a type allowlist covering A, AAAA, CAA, CNAME, DNAME, LOC, MX, NAPTR, NS, RP, SRV, SSHFP, TLSA, and TXT.

Attack Vector

An attacker requires an authenticated Froxlor customer account with DNS-zone permissions. The attacker submits a crafted record field containing newline or tab characters followed by an additional record definition, or supplies an unsupported type value that reaches the zone-file writer. After Froxlor regenerates the BIND zone file, the injected records take effect on the next zone reload.

php

 		}
 
 		$record = trim(strtolower($record));
+		// remove invalid control characters (printable ASCII) from record
+		$record = preg_replace('/[^\\x20-\\x7E]/', '', $record);
+
+		$type = trim(strtoupper($type));
+		if (!in_array($type, [
+			'A',
+			'AAAA',
+			'CAA',
+			'CNAME',
+			'DNAME',
+			'LOC',
+			'MX',
+			'NAPTR',
+			'NS',
+			'RP',
+			'SRV',
+			'SSHFP',
+			'TLSA',
+			'TXT'
+		])) {
+			$errors[] = lng('error.dns_unknown_type');
+		}
 
 		if ($record != '@' && $record != '*') {
 			// validate record

Source: GitHub Commit a4f09f0 - this patch adds control-character stripping and a strict record-type allowlist in DomainZones.php.

Detection Methods for CVE-2026-54543

Indicators of Compromise

Unexpected resource records appearing in BIND zone files managed by Froxlor, especially records not linked to a user-visible entry in the Froxlor UI.
Zone-file lines containing unusual whitespace patterns, embedded semicolons, or record types not enumerated in Froxlor's DNS editor.
BIND named errors on zone reload referencing malformed or duplicate records in customer-managed zones.

Detection Strategies

Compare Froxlor's database view of zone records against the generated BIND zone file to identify records present on disk but absent from the application state.
Audit the Froxlor API access log for DomainZones.add calls containing encoded newline (%0A, %0D) or tab (%09) characters in the record or type parameters.
Enable BIND query logging and diff resolved answers against expected zone content to spot injected records serving unauthorized data.

Monitoring Recommendations

Alert on any DomainZones.add API request whose payload contains control characters or record-type values outside the supported allowlist.
Monitor zone-file regeneration jobs for warnings from named-checkzone and treat new warnings as high-priority events.
Track customer accounts with DNS-zone permissions for anomalous rates of zone-add operations.

How to Mitigate CVE-2026-54543

Immediate Actions Required

Upgrade Froxlor to version 2.3.8 or later on all managed servers.
Audit existing BIND zone files for injected records introduced before patching, using named-checkzone and diffs against Froxlor's database.
Review DNS-zone permission grants and revoke access for customer accounts that do not require zone management.

Patch Information

The fix is available in Froxlor 2.3.8. The patch, tracked in commit a4f09f0, enforces a printable-ASCII allowlist on the record field and restricts type to a defined set of DNS record types. Full advisory details are in GHSA-5rw4-4665-cvwf.

Workarounds

Temporarily revoke DNS-zone permissions from customer accounts until the upgrade to 2.3.8 is complete.
Add a reverse-proxy or WAF rule rejecting DomainZones.add API requests that contain control characters in POST parameters.
Run named-checkzone as part of zone-file regeneration and refuse to reload zones that fail validation.

bash

# Validate every Froxlor-generated zone file before reload
for zone in /etc/bind/froxlor-zones/*.zone; do
  named-checkzone "$(basename "$zone" .zone)" "$zone" || {
    echo "Zone validation failed: $zone" >&2
    exit 1
  }
done
rndc reload