CVE-2026-54543: DNS Resource Record (RR) Injection in Froxlor DomainZones API

Froxlor is an open-source server administration control panel that enables administrators to manage domains, web hosting, email accounts, and DNS zones. Among its core capabilities is a DNS management system that interfaces directly with Berkeley Internet Name Domain (BIND) to generate and maintain authoritative DNS zone files. This configuration relies on database entries containing domain definitions, which are periodically serialized into standard, space-delimited configuration files.

The core of the vulnerability resides in the DomainZones.add API command, implemented in the PHP file lib/Froxlor/Api/Commands/DomainZones.php. An authenticated user with domain editing privileges can request the addition of custom DNS resource records. However, because the application did not sanitize the record or type inputs prior to serialization, an attacker can input carriage returns, line feeds, and horizontal tabs into these fields to inject downstream commands.

The primary risk associated with this flaw is DNS injection, which corresponds to CWE-74. If successfully exploited, an attacker can hijack resolution paths for specific domains, creating unauthorized TXT, MX, or A records. Because the DNS server acts as the source of truth for the local network segment or the internet, this permits the attacker to bypass access controls or spoof trusted identities.

To understand the root cause, one must examine how BIND processes zone files. BIND zone files are strictly line-oriented text files. Each physical line defines a single resource record or a structural directive unless explicitly continued using parentheses. Elements within a record—such as the owner name, TTL, class, record type, and resource data (RDATA)—are separated by whitespace, which can be spaces or horizontal tabs (\t).

The vulnerability exists because Froxlor's serialization system in lib/Froxlor/Dns/DnsEntry.php took user-defined parameters from the database and concatenated them directly into the output stream during the periodic cron-based zone file generation. Because the application did not validate that the $record parameter consists solely of alphanumeric characters and periods, or that the $type parameter is a valid DNS record class, it was possible to pass control characters directly to the generation engine.

Specifically, when an attacker injects a Line Feed (\n) or Carriage Return and Line Feed (\r\n) into the record parameter, BIND parses the single input field as multiple structural lines. By structuring the payload to contain a newline sequence followed by a valid DNS record format, and concluding with a semicolon (;), the attacker effectively ends the legitimate record early, inserts a custom record on the next line, and comments out the remainder of the system-generated configuration line. This breaks the syntactic boundary of the original database entry and forces BIND to load unauthorized zones.

Prior to the security patch in commit a4f09f09fa71337b6cdff364d0a641d631a0130a, the API accepted both $record and $type with minimal validation, simply trimming whitespace and applying basic structural handling. This allowed raw injection into the configuration file.

// Vulnerable Code Path
$record = trim(strtolower($record));
// No character validation was performed on $record
// No allowlist check existed for the $type parameter

The remediation introduces a strict character filtering pass on $record and a structural allowlist validation on $type within lib/Froxlor/Api/Commands/DomainZones.php. Below is an analysis of the critical modifications:

// Patched Code
$record = trim(strtolower($record));
// Remove invalid control characters (allowing only printable ASCII)
$record = preg_replace('/[^\x20-\x7E]/', '', $record);
 
$type = trim(strtoupper($type));
// Strict type allowlist validation
if (!in_array($type, [
    'A',
    'AAAA',
    'CAA',
    'CNAME',
    'DNAME',
    'LOC',
    'MX',
    'NAPTR',
    'NS',
    'RP',
    'SRV',
    'SSHFP',
    'TLSA',
    'TXT'
])) {
    $errors[] = lng('error.dns_unknown_type');
}

The application of the regular expression /[^\x20-\x7E]/ completely strips all control characters, including vertical tabs, line breaks, and null bytes, neutralizing the ability to generate a physical line break in BIND's output file. Additionally, the explicit validation of $type against the standard DNS records array prevents attackers from specifying non-standard records or injecting spaces inside the type parameter. Lastly, the patch routes the cleaned domain string through a secondary RFC-compliant domain validation test via Validate::validateDomain(). This ensures that even printable but syntactically illegal DNS characters (such as semicolons and spaces) are rejected before being written to the database.

Exploiting CVE-2026-54543 requires the attacker to hold an authenticated customer account with active privileges to manage DNS entries. This is represented by the database fields isbinddomain == 1 and system-wide setting dnsenabled == 1. The attack is executed over HTTP or HTTPS by interacting with the administrative API or user interface.

An attacker crafts a request targeting the DomainZones.add API command. The payload modifies the record parameter by appending a Carriage Return Line Feed (\r\n) sequence, followed by an instruction to insert a TXT or MX record, and ending with a semicolon (;).

POST /lib/ajax.php?action=add HTTP/1.1
Host: target-panel.local
Content-Type: application/x-www-form-urlencoded
Cookie: froxlor_session=xyz
 
domain_id=12&record=subdomain%0d%0a%09IN%09TXT%09%22vulnerable-proof%22%0d%0a%3b&type=A&content=127.0.0.1

When processed, the resulting configuration file will contain a standard A record definition immediately followed by a new line that BIND parses as a discrete, authoritative TXT record. The trailing semicolon ensures that the original remaining configuration generated by Froxlor is interpreted as a comment, preventing syntax errors that would trigger BIND loading errors and expose the manipulation to system administrators monitoring error logs.

The impact of CVE-2026-54543 is categorized as Medium, with a CVSS v3.1 score of 5.4. While the vulnerability requires authentication, the impact is limited to the DNS zones that the authenticated customer has permission to manage. However, within those authorized zones, the integrity of the name resolution service is completely compromised.

An attacker can abuse this flaw to conduct localized domain hijacking. For example, an attacker could inject MX records pointing to an external rogue mail server, allowing them to intercept inbound email transmissions intended for subdomains within the hijacked zone. This facilitates subsequent attacks, such as password resets or credential harvesting.

Additionally, the injection of TXT records allows attackers to generate SPF, DKIM, or DMARC records, or complete domain validation challenges (e.g., ACME certificates, Google Webmaster tools). This allows them to issue valid SSL certificates or authenticate outbound phishing emails as originating from the victim's domain name, significantly elevating the risk of social engineering campaigns.

The standard remediation for this vulnerability is to upgrade the Froxlor installation to version 2.3.8 or above. This version contains the complete fix, restricting the record parameter to printable ASCII and enforcing a strict allowlist on the type parameter.

For deployments where upgrading immediately is not possible, administrators should apply manual code modifications to the file lib/Froxlor/Api/Commands/DomainZones.php. To secure the input vectors, insert the regular expression filter to strip non-printable ASCII and enforce a strict array search check on the $type parameter before any SQL database inserts or updates occur.

Additionally, system administrators can audit existing zone files for indicators of compromise. Run a search across the DNS directories to find anomalous semicolon characters at the end of configuration lines or suspicious whitespace sequences:

grep -rE "^\s*;|;\s*$" /var/lib/froxlor/dns/

Database monitoring can also assist in detecting active exploitation. Examine the query log or execute direct lookups on the panel_dns table to locate any records containing control characters, line breaks, or carriage returns.