GHSA-47hf-23pw-3m8c: Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
Summary`DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., `NAPTR`, `PTR`, `HINFO`), content validation is entirely bypassed. Embedded newline characters in the content survive `trim()` processing, are stored in the database, and are written directly into BIND zone files via `DnsEntry::__toString()`. An authenticated customer can inject arbitrary DNS records and BIND directives (`$INCLUDE`, `$ORIGIN`, `$GENERATE`) into their domain's zone file.Details**Missing type whitelist — `DomainZones.php:93`:**The `type` parameter is accepted directly from user input with no validation against allowed values:The if/elseif chain at lines 170-317 validates content only for 13 known types: `A`, `AAAA`, `CAA`, `CNAME`, `DNAME`, `LOC`, `MX`, `NS`, `RP`, `SRV`, `SSHFP`, `TLSA`, `TXT`. Any type not in this list falls through with no content validation at all. There is a `TODO` comment at line 148 acknowledging missing validation:**Missing newline sanitization — `DomainZones.php:154`:**The content field only receives `trim()`, which strips leading/trailing whitespace but preserves embedded newline characters:**Unsafe zone file output — `DnsEntry.php:83`:**`DnsEntry::__toString()` concatenates content directly into zone file format without escaping:Newlines in `$_content` produce new lines in the zone file, each parsed by BIND as an independent resource record or directive.**Zone file write — `Bind.php:121`:**The `AntiXSS` filter applied at the API layer (`Api.php:91`) targets HTML/JS XSS vectors and does not strip newline characters. The web UI form restricts types via a dropdown (`formfield.dns_add.php:42-56`), but this is client-side only — the server-side `DomainZones::add()` has no corresponding whitelist.**Execution flow:**Customer sends API request with `type=NAPTR` and `content` containing `\n`-separated lines`getParam()` returns raw values without sanitizationType `NAPTR` matches none of the if/elseif conditions — no content validation runs`trim($content)` preserves embedded newlinesContent is inserted into `domain_dns` table via prepared statementDNS cron creates `DnsEntry` objects from DB records (`Dns.php:297`)`DnsEntry::__toString()` outputs content with embedded newlines into zone format`Bind.php:121` writes zone to disk; BIND loads the file and processes injected lines as recordsPoC**Step 1: Inject a DNS record with embedded newlines via API**Expected: HTTP 200 with success response. The record is stored in the database.**Step 2: Wait for DNS cron to rebuild zones (or trigger manually)****Step 3: Inspect the generated zone file**Expected zone file content includes injected lines:The line `@ 300 IN A 1.2.3.4` is parsed by BIND as an independent A record pointing the domain to the attacker's IP.**Step 4: Verify BIND directive injection**This injects a `$GENERATE` directive that creates 255 PTR records.ImpactAn authenticated customer with DNS editing enabled can:**Inject arbitrary DNS records** bypassing all content validation — including A/AAAA records pointing the domain to attacker-controlled IPs, redirecting legitimate traffic.**Manipulate email authentication** by injecting TXT records to override SPF, DKIM, or DMARC policies, enabling email spoofing for the domain.**Inject BIND server directives** (`$INCLUDE`, `$ORIGIN`, `$GENERATE`) that escape the DNS record context and can attempt to include local server files, alter zone origin, or mass-generate records.**Cause DNS service disruption** by injecting malformed records or conflicting directives that cause the zone file to fail loading, disrupting DNS resolution for all records in the domain.While this requires an authenticated customer account, DNS editing is a standard feature in shared hosting environments. In a multi-tenant deployment, a malicious customer can abuse this to disrupt the DNS server or inject records that bypass validation controls designed to protect zone integrity.Recommended Fix**1. Add a type whitelist in `DomainZones::add()` (primary fix):****2. Strip newline characters from content (defense-in-depth):****3. Sanitize in `DnsEntry::__toString()` as a belt-and-suspenders measure:**
CVSS v3.1: 8.5