CVE-2026-54543

Executive Summary

CVE-2026-54543 is an injection vulnerability in Froxlor, an open-source server administration software package, affecting all versions prior to 2.3.8. The flaw resides in the DomainZones.add API command, which fails to properly sanitize user-supplied DNS record values, allowing an authenticated customer with DNS-zone management permissions to inject arbitrary resource records into BIND zone files. Successful exploitation permits modification of DNS data and can impact DNS availability within the managed zone; the vulnerability carries a CVSS score of 5.4 (medium severity) with low confidentiality and availability impacts.

Technical Analysis

The vulnerability exists within Froxlor's API layer, specifically in the DomainZones.add command implemented in lib/Froxlor/Api/Commands/DomainZones.php. The affected code path accepts two user-controlled parameters — the DNS record value and a related type field — and processes them without rejecting dangerous characters or unsupported DNS record types.

The core issue is a classic injection flaw categorized under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The application fails to validate or reject the following inputs before they are passed to the DNS serialization layer:

• Line delimiters (e.g., carriage return and newline characters) — an attacker can terminate the current resource record line and begin writing a new line in the zone file.
• Tab characters — can be used for formatting injection or to align injected content.
• Semicolons — in BIND zone file syntax, semicolons denote comments; an attacker could use semicolons to comment out legitimate subsequent records or to obscure injected content from parsing.
• Unsupported DNS record types — passing unexpected record types may bypass validation logic that is type-specific.

Once the crafted values pass through the API command, they are serialized by lib/Froxlor/Dns/DnsEntry.php into a BIND zone file. The serialization process does not perform additional sanitization, meaning the raw attacker-controlled bytes are written into the zone file. Since BIND (the DNS server) treats the zone file as authoritative, it parses all resource records present, including the injected lines. This allows the attacker to add SPF/TXT records, NS records, or other record types that modify DNS behavior at the zone level.

Because field-level validation is performed before data reaches the serialization layer but fails to reject the dangerous input characters, the injection bypasses the intended security controls. The attacker need only be an authenticated customer with permissions to manage DNS zones within the Froxlor installation — an access level consistent with standard hosting customers in a multi-tenant environment.

Exploitation Scenarios

Step 1: Reconnaissance / Target Identification
An attacker first identifies a Froxlor installation running a version prior to 2.3.8. Fingerprinting can be performed through HTTP headers, login page titles, or version disclosure in page source. The attacker then obtains or registers a valid account with DNS-zone management permissions (or compromises an existing low-privileged account through credential stuffing or phishing).

Step 2: Flaw Trigger
The attacker authenticates to the Froxlor control panel and invokes the DomainZones.add API command via the application's API interface. The API call includes the domain_id, record, and type parameters, where the record field is the primary injectable vector.

Step 3: Payload Construction / Execution
The record field is populated with a crafted value containing a legitimate DNS record name followed by a newline character (e.g., \n), additional resource record data, and a tab character to separate fields. Example at the vulnerability-class level:
legitimate.example.com\n@ 3600 IN TXT "attacker-controlled"

This payload terminates the original DNS record line and injects a new TXT record into the zone file. Alternatively, the attacker can inject NS records pointing to malicious DNS servers, or comment out legitimate records using semicolons to degrade zone functionality. Because the type field also accepts untrusted input without validation, a second injection vector exists via type-field manipulation.

Step 4: Post-Exploitation Impact

• DNS Data Modification: Injected TXT records can be used for domain-verification bypass (e.g., proving control of a domain to third-party services), SPF record modification (email spoofing for the domain), or DKIM/SPF subdomain delegation.
• Zone Corruption / Availability Impact: Injecting malformed records or excessive comment lines can corrupt the zone file, causing BIND to fail zone loading or reject dynamic updates, leading to DNS resolution failures for the affected domain.
• Persistence: Once written, the injected records remain in the zone file until manually removed by the administrator, providing persistent DNS manipulation.

No public proof-of-concept is currently available; the attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

CVSS Analysis: The vulnerability scores 5.4 on the CVSS 3.1 scale (Medium severity). The vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L indicates:

• Attack Vector: Network — the flaw is exploitable remotely via the Froxlor API.
• Attack Complexity: Low — no special conditions are required beyond valid credentials.
• Privileges Required: Low — authenticated user with DNS-zone permissions suffices.
• User Interaction: None — no victim interaction is needed.
• Confidentiality Impact: Low — limited information disclosure potential.
• Integrity Impact: Low — attacker can modify DNS records within an authorized zone.
• Availability Impact: Low — zone corruption may result in DNS availability degradation.

Business Impact: For managed hosting providers using Froxlor, exploitation could result in:

• DNS hijacking of customer domains through NS record injection, enabling traffic interception or email spoofing.
• Reputational damage to the hosting provider if customers' domains experience DNS outages.
• Compliance violations (e.g., GDPR, SOC 2) if DNS manipulation leads to data exposure via misrouted traffic.
• In a multi-tenant environment, the blast radius is typically limited to zones the authenticated caller is permitted to manage, but privilege escalation beyond DNS management could amplify impact.

Affected Systems: All Froxlor installations running versions prior to 2.3.8 with the API enabled and DNS-zone management exposed to customers. Systems where the API is disabled or only accessible to administrators are not exposed.

Detection Guidance

Sigma Rule

title: Froxlor DomainZones.add DNS Record Injection Attempt
status: experimental
description: Detects attempts to exploit CVE-2026-54543 by injecting line delimiters or semicolons into Froxlor DNS zone records via the DomainZones.add API command
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54543
author: vartersit.com Threat Intelligence
date: 2026/01/01
logsource:
    product: froxlor
    service: api
detection:
    selection:
        EventID: API_CALL
        CommandName: 'DomainZones.add'
    filter_keywords:
        Record|contains:
            - '\n'
            - '\r'
            - ';'
            - '\t'
        Type|contains:
            - '\n'
            - '\r'
            - ';'
    condition: selection and filter_keywords
level: high
falsepositives:
    - Legitimate DNS records containing semicolons in TXT values (rare)

YARA Rule

rule Froxlor_DomainZones_Injection_CVE_2026_54543 {
    meta:
        author = "vartersit.com Threat Intelligence"
        description = "Detects suspicious record/type values in Froxlor DomainZones.add API calls containing line delimiters or semicolons"
        cve = "CVE-2026-54543"
        date = "2026-01-01"
    strings:
        $api_endpoint = "DomainZones.add" ascii wide nocase
        $line_break = { 0D 0A 7C 0A 7C 09 }
        $semicolon = ";" ascii wide
        $newline = "\n" ascii wide
        $crlf = "\r\n" ascii wide
    condition:
        $api_endpoint and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Froxlor DomainZones.add DNS Record Injection (CVE-2026-54543)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"DomainZones.add"; nocase; pcre:"/(record|type)=[^&]*(%0[$dD]|%0[adA]|%09|%3[Bb])/Ui"; classtype:attempted-admin; sid:2000001; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026_54543;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [ http where process.name == "php-fpm" and url.path like "*DomainZones.add*" and url.query like "*(%0[dD]|%0[aA]|%09|%3[bB])*" ]
  [ file where process.name == "php-fpm" and (file.name == "*.zone" or file.name == "*.db") and file.extension == "zone" and message like "*IN TXT*" ]

Splunk SPL Query

index=web sourcetype=access_combined
  uri="*DomainZones.add*"
  (bytes_hex="0D0A" OR form_data="*%0d*" OR form_data="*%0D*" OR form_data="*%0a*" OR form_data="*%0A*" OR form_data="*%09*")
  | stats count by src_ip, uri, form_data
  | where count > 3
  | table _time, src_ip, uri, form_data, count

Wazuh OSSEC Rule

<group name="froxlor,">
  <rule id="545430" level="10">
    <if_sid>999</if_sid>
    <match>DomainZones.add</match>
    <regex>(\%0[dD]|\%0[aA]|\%09|\%3[bB]|;\s*\r?\n)</regex>
    <description>Potential DNS record injection attempt via Froxlor DomainZones.add (CVE-2026-54543)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source is currently available. The vendor has indicated a fix in version 2.3.8, but as of this report, no patch confirmation from authoritative sources exists.

Immediate Mitigations (until patch is verified):

1. Restrict API access: Disable the API endpoint or restrict access to DomainZones.add to only trusted administrative users rather than allowing all authenticated customers.
2. Input validation at the proxy level: Deploy a WAF (Web Application Firewall) rule that blocks API requests containing encoded line delimiters (%0A, %0D, %09) or semicolons in record or type parameters.
3. File integrity monitoring: Enable file integrity monitoring on BIND zone files to alert on unexpected modifications.
4. DNS zone signing (DNSSEC): If not already deployed, enable DNSSEC to detect unauthorized record modification at the resolver level.

Patch/Upgrade Steps:

1. Monitor the Froxlor releases page for version 2.3.8 or later.
2. When available, upgrade all Froxlor installations to version 2.3.8 following the vendor's upgrade documentation.
3. After upgrade, verify the version and retest the DomainZones.add API endpoint with payloads containing line delimiters to confirm the fix.
4. Verify that all BIND zone files are intact and free of unauthorized records.

Long-term Hardening:

1. Implement principle of least privilege: ensure customers only have DNS-zone permissions for domains they legitimately own.
2. Conduct regular security reviews of API input validation logic, particularly for commands that serialize data into flat files.
3. Segment DNS infrastructure from web-facing application servers where feasible.
4. Maintain updated backup copies of zone files to expedite recovery from corruption attacks.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54543 — Contains the official NVD description, CVSS vector, and reference documentation.
2. Froxlor Official Website: https://froxlor.org/ — Vendor project page; version 2.3.8 release notes will be published here.
3. Froxlor GitHub Repository: https://github.com/Froxlor/Froxlor — Source code repository containing the vulnerable files (lib/Froxlor/Api/Commands/DomainZones.php and lib/Froxlor/Dns/DnsEntry.php) and the fix commit when released.
4. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Reference for the "Exploit Public-Facing Application" technique relevant to this vulnerability.
5. CWE-74 Reference: https://cwe.mitre.org/data/definitions/74.html — Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Known Threat Actor Campaigns: None reported at the time of publication. No exploit-in-the-wild evidence or CISA KEV inclusion exists.