Executive brief
Froxlor is a web hosting control panel that manages DNS zones for customer domains. An authenticated customer can inject malicious DNS records into zones they should only be able to manage through crafted API calls, bypassing validation controls. This allows an attacker to modify DNS zone integrity, redirect domain traffic, or degrade DNS service for domains under their control, causing business and customer impact.
Technical details
Froxlor DomainZones.add API command performs insufficient input validation on the DNS record name and record type fields. The vulnerability exists in lib/Froxlor/Api/Commands/DomainZones.php where record and type parameters are trimmed, lowercased, and IDNA-encoded but do not reject control characters, tabs, newlines, or semicolon delimiters. These unsanitized values are later written to BIND zone files by DnsEntry::__toString(), allowing an attacker to inject additional DNS resource records. For example, submitting record="www\t60\tIN\tA\t6.6.6.6 ;\n@" causes BIND to parse two separate A records instead of one. The attack requires prior authentication with DNS-zone management permissions on the domain, but no additional user interaction. BIND silently accepts the malformed zone file and processes injected records as legitimate. Patch version 2.3.8 is available.
Affected products
- Froxlor Froxlor <= 2.3.7
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched: Patch version 2.3.8 released
- 2026-08-18: advisory