Most recent entries from all

EUVD-2026-292751

fkie_cve-2026-41230

Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., `NAPTR`, `PTR`, `HINFO`), content validation is entirely bypassed. Embedded newline characters in the content survive `trim()` processing, are stored in the database, and are written directly into BIND zone files via `DnsEntry::__toString()`. An authenticated customer can inject arbitrary DNS records and BIND directives (`$INCLUDE`, `$ORIGIN`, `$GENERATE`) into their domain's zone file. Version 2.3.6 fixes the issue.

GHSA-47hf-23pw-3m8c — Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

Affected: Packagist: froxlor/froxlor

## Summary

`DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., `NAPTR`, `PTR`, `HINFO`), content validation is entirely bypassed. Embedded newline characters in the content survive `trim()` processing, are stored in the database, and are written directly into BIND zone files via `DnsEntry::__toString()`. An authenticated customer can inject arbitrary DNS records and BIND directives (`$INCLUDE`, `$ORIGIN`, `$GENERATE`) into their domain's zone file.

## Details

**Missing type whitelist — `DomainZones.php:93`:**

The `type` parameter is accepted directly from user input with no validation against allowed values:

```php // lib/Froxlor/Api/Commands/DomainZones.php:93 $type = $this->getParam('type', true, 'A'); ```

The if/elseif chain at lines 170-317 validates content only for 13 known types: `A`, `AAAA`, `CAA`, `CNAME`, `DNAME`, `LOC`, `MX`, `NS`, `RP`, `SRV`, `SSHFP`, `TLSA`, `TXT`. Any type not in this list falls through with no content validation at all. There is a `TODO` comment at line 148 acknowledging missing validation:

```php // TODO regex validate content for invalid characters ```

**Missing newline sanitization — `DomainZones.php:154`:**

The content field only receives `trim()`, which strips leading/trailing whitespace but preserves embedded newline characters:

```php // lib/Froxlor/Api/Comm…

WID-SEC-W-2026-1124 — Froxlor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Dateien zu manipulieren.