PT-2026-46116 · Froxlor+1 · Froxlor+1
CVSS v3.1
7.6
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Froxlor versions prior to 2.3.7
Description
The 'DomainZones.add' API endpoint fails to sanitize newline characters within TXT record content. An authenticated customer with DNS editing permissions can inject newlines into TXT record values, allowing them to break out of the record line in the generated BIND zone file. This enables the injection of arbitrary DNS records (such as A, MX, and CNAME) and BIND directives, specifically
$INCLUDE and $GENERATE.Technical exploitation can lead to:
- Information Disclosure: Using the
$INCLUDEdirective to force BIND to read world-readable files from the server. - DNS Record Injection: Creating unauthorized subdomains or intercepting email by injecting A, MX, or CNAME records.
- DNS Service Disruption: Causing BIND to reject the zone file due to malformed content or using
$GENERATEto create massive record sets for amplification.
The issue resides in the
Dns::encloseTXTContent() function, which only manages surrounding quotes and does not strip newlines, carriage returns, or BIND zone metacharacters.Recommendations
Update to version 2.3.7.
As a temporary workaround, restrict access to the 'DomainZones.add' API endpoint or disable DNS editing for customers until the update is applied.
Exploit
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bind
Froxlor