GHSA-5rw4-4665-cvwf

Suggest an improvement
Source
https://github.com/advisories/GHSA-5rw4-4665-cvwf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-5rw4-4665-cvwf/GHSA-5rw4-4665-cvwf.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-5rw4-4665-cvwf
Aliases
Published
2026-08-18T20:48:04Z
Modified
2026-08-18T21:11:20Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Details

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters.

The stronger variant is in record. An authenticated customer with DNS-zone permissions can submit a normal A record request where record is:

www\t60\tIN\tA\t6.6.6.6 ;\n@

with type=A and content=127.0.0.1. The current record flow trims/lower-cases/IDNA-encodes the value, but does not reject CR/LF/HTAB or semicolon. The real Froxlor\Dns\DnsEntry::__toString() sink renders it as:

www 60 in a 6.6.6.6 ; @ 18000 IN A 127.0.0.1

BIND accepts the generated zone file:

named-checkzone example.com froxlor_dns_record_injected.zone zone example.com/IN: loaded serial 2026060501 OK

named-compilezone -D confirms both records are parsed as real DNS RRs:

example.com. 18000 IN A 127.0.0.1 www.example.com. 60 IN A 6.6.6.6 zone example.com/IN: loaded serial 2026060501 OK

Affected code in 2.3.7:

  • lib/Froxlor/Api/Commands/DomainZones.php:92-93 reads record/type from API params.
  • lib/Froxlor/Api/Commands/DomainZones.php:122-136 trims/lower-cases/IDNA-encodes record without control-character rejection.
  • lib/Froxlor/Api/Commands/DomainZones.php:157-160 hardens content only.
  • lib/Froxlor/Api/Commands/DomainZones.php:314-321 and 347-357 store record/type/content into domain_dns_entries.
  • lib/Froxlor/Dns/Dns.php:297 passes stored values to DnsEntry.
  • lib/Froxlor/Dns/DnsEntry.php:83 concatenates record/type/content into a zone-file line.

There is also a related type-field variant because type is not allowlisted and domain_dns_entries.type is varchar(10). The value NS\tns.\n@\tA renders one submitted entry as multiple zone-file records.

Impact: authenticated customer with DNS-zone permissions can inject additional BIND resource-record lines into the generated zone file for a domain they can manage in Froxlor, bypassing Froxlor's DNS field-level validation. This is DNS zone integrity loss and possible DNS availability impact inside the caller's manageable zone.

Suggested remediation: allowlist DNS RR types, reject CR/LF/HTAB/control chars/spaces/semicolon in record and type, validate record as a DNS owner name while allowing intended cases such as @, *, *.label, _service._proto, _dmarc, and DKIM selectors. Add defense-in-depth in DnsEntry or the DNS serializer so CR/LF cannot reach generated zone lines.

Attribution: Yaohui Wang.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T20:48:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

Packagist / froxlor/froxlor

Package

Name
froxlor/froxlor
Purl
pkg:composer/froxlor/froxlor

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.3.8

Affected versions

0.*
0.10.0-rc1
0.10.0-rc2
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.10.10
0.10.11
0.10.12
0.10.13
0.10.14
0.10.15
0.10.16
0.10.17
0.10.18
0.10.19
0.10.20
0.10.21
0.10.22
0.10.23
0.10.23.1
0.10.24
0.10.25
0.10.26
0.10.27
0.10.28
0.10.29
0.10.29.1
0.10.30
0.10.31
0.10.32
0.10.33
0.10.34
0.10.34.1
0.10.35
0.10.35.1
0.10.36
0.10.37
0.10.38
0.10.38.1
0.10.38.2
0.10.38.3
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.1.0-beta1
2.1.0-beta2
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0-rc1
2.2.0-rc2
2.2.0-rc3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.3.0-rc1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7

Database specific

last_known_affected_version_range 
"<= 2.3.7"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-5rw4-4665-cvwf/GHSA-5rw4-4665-cvwf.json"