{"uuid": "2a2dba25-f141-48d0-9309-63fb9bbc7d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-5rw4-4665-cvwf", "type": "seen", "source": "https://gist.github.com/alon710/ac73b2e180b3b5bc212b2c31ca85b161", "content": "# CVE-2026-54543: CVE-2026-54543: DNS Resource Record (RR) Injection in Froxlor DomainZones API\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54543\n\n## Summary\nCVE-2026-54543 is a DNS Resource Record (RR) Injection vulnerability in Froxlor, an open-source server administration control panel. Prior to version 2.3.8, the DomainZones.add API command failed to perform strict sanitization and validation on the user-controlled record (label) and type parameters before serializing them into BIND-compatible zone files. An authenticated customer with DNS zone management permissions can inject control characters, breaking out of the original record context to define unauthorized resource records within managed zones.\n\n## TL;DR\nAuthenticated users with DNS edit permissions can inject arbitrary DNS records into BIND zone files via Froxlor's unsanitized DomainZones.add API.\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network\n- **CVSS**: 5.4 (Medium)\n- **EPSS**: Not Assigned\n- **Impact**: DNS manipulation within managed zones\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Froxlor Server Administration Control Panel prior to 2.3.8\n- **Froxlor**: < 2.3.8 (Fixed in: `2.3.8`)\n\n## Mitigation\n\n- Upgrade Froxlor to version 2.3.8 or higher.\n- Implement a WAF rule to filter control characters like CR, LF, and semicolon from domain validation parameters.\n- Perform scheduled integrity scans of generated BIND zone configuration files on the host.\n\n**Remediation Steps:**\n1. Fetch the latest stable release of Froxlor 2.3.8 using Git or your system package manager.\n2. Apply the patch from commit a4f09f09fa71337b6cdff364d0a641d631a0130a to existing 2.3.x systems if an immediate major upgrade is not possible.\n3. Validate the output BIND zone configuration files for formatting compliance.\n4. Restart or reload the BIND system service to flush any active injected cache entries.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/froxlor/froxlor/security/advisories/GHSA-5rw4-4665-cvwf)\n- [Vulnerability Remediation Commit](https://github.com/froxlor/froxlor/commit/a4f09f09fa71337b6cdff364d0a641d631a0130a)\n- [Froxlor 2.3.8 Release Notes](https://github.com/froxlor/froxlor/releases/tag/2.3.8)\n- [CVE Record Details on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54543)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54543) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T12:33:17.954388Z"}