📄 Description (English)
Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.
🤖 AI Executive Summary
Froxlor versions prior to 2.3.5 contain a critical DNS zone file injection vulnerability in the DomainZones.add API endpoint. Attackers with DNS-enabled customer accounts can inject BIND directives (such as $INCLUDE) into DNS records, leading to arbitrary file inclusion and potential remote code execution when the DNS rebuild cron job executes. This vulnerability is actively exploitable and requires immediate patching.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 23, 2026 01:06
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses significant risk to Saudi hosting providers, domain registrars, and organizations using Froxlor for DNS management. Primary impact sectors include: (1) Telecommunications providers (STC, Mobily, Zain) managing DNS infrastructure; (2) Government entities (NCA, CITC) operating DNS services; (3) Banking sector (SAMA-regulated institutions) relying on Froxlor for domain management; (4) Energy sector (ARAMCO subsidiaries) using Froxlor for infrastructure DNS. The vulnerability enables privilege escalation from customer-level access to server-level code execution, potentially compromising entire hosting infrastructure and downstream customers' domains.
🏢 Affected Saudi Sectors
Telecommunications (STC, Mobily, Zain)
Government (NCA, CITC)
Banking (SAMA-regulated institutions)
Energy (ARAMCO, subsidiaries)
Hosting Providers
Domain Registrars
Healthcare (MOH DNS infrastructure)
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.9
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all Froxlor installations in your environment and verify versions prior to 2.3.5
2. Restrict API access to DomainZones.add endpoint to trusted administrators only
3. Disable DNS functionality for non-essential customer accounts until patching is complete
4. Review DNS zone files for suspicious $INCLUDE directives or unusual content
PATCHING:
1. Upgrade Froxlor to version 2.3.5 or later immediately
2. Test patches in staging environment before production deployment
3. Verify DNS zone file integrity post-upgrade
COMPENSATING CONTROLS (if immediate patching not possible):
1. Implement input validation at firewall/WAF level to block requests containing BIND directives ($INCLUDE, $DEFINE, etc.)
2. Monitor DNS zone file modifications in real-time using file integrity monitoring (FIM)
3. Restrict cron job execution permissions to read-only zone file access
4. Implement API rate limiting and authentication hardening for DomainZones endpoints
DETECTION:
1. Search zone files for patterns: \$INCLUDE, \$DEFINE, \$ORIGIN with suspicious paths
2. Monitor API logs for DomainZones.add requests containing newline characters (%0A, %0D)
3. Alert on unexpected DNS zone file modifications outside scheduled rebuild windows
4. Monitor for LOC, RP, SSHFP, TLSA record creation with embedded directives
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. حدد جميع تثبيتات Froxlor في بيئتك والتحقق من الإصدارات السابقة للإصدار 2.3.5
2. قيد الوصول إلى API لنقطة نهاية DomainZones.add للمسؤولين الموثوقين فقط
3. عطل وظيفة DNS لحسابات العملاء غير الضرورية حتى اكتمال التصحيح
4. راجع ملفات منطقة DNS بحثًا عن توجيهات $INCLUDE المريبة أو المحتوى غير المعتاد
التصحيح:
1. قم بترقية Froxlor إلى الإصدار 2.3.5 أو أحدث على الفور
2. اختبر التصحيحات في بيئة التجميع قبل نشر الإنتاج
3. تحقق من سلامة ملف منطقة DNS بعد الترقية
الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكنًا):
1. تنفيذ التحقق من الإدخال على مستوى جدار الحماية/WAF لحظر الطلبات التي تحتوي على توجيهات BIND
2. مراقبة تعديلات ملف منطقة DNS في الوقت الفعلي باستخدام مراقبة سلامة الملفات
3. تقييد أذونات تنفيذ مهام cron للوصول إلى ملفات المنطقة بقراءة فقط
4. تنفيذ تحديد معدل API وتقوية المصادقة لنقاط نهاية DomainZones
الكشف:
1. ابحث في ملفات المنطقة عن الأنماط: $INCLUDE و $DEFINE و $ORIGIN مع المسارات المريبة
2. مراقبة سجلات API لطلبات DomainZones.add التي تحتوي على أحرف سطر جديد
3. تنبيه على تعديلات ملف منطقة DNS غير المتوقعة خارج نوافذ إعادة البناء المجدولة
4. مراقبة إنشاء سجلات LOC و RP و SSHFP و TLSA مع توجيهات مضمنة
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.14.2.1 - Information security change management
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
ECC 2024 A.14.3.1 - Segregation of development, test and production environments
🔵 SAMA CSF
SAMA CSF ID.BE-3.1 - Organizational resilience objectives
SAMA CSF PR.DS-6 - Data is protected from unauthorized access
SAMA CSF DE.CM-1 - The network is monitored to detect potential cybersecurity events
🟡 ISO 27001:2022
ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities
ISO 27001:2022 A.14.2.1 - Change management
ISO 27001:2022 A.8.3.1 - User registration and access rights management
ISO 27001:2022 A.14.3.1 - Segregation of development, test and production environments
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Ensure all system components and software are protected from known vulnerabilities
PCI DSS 6.5.1 - Injection flaws prevention
🔗 References & Sources 3
🔗
https://github.com/froxlor/froxlor/commit/b34829262dc32818b37f6a1eabb426d0b277a86b
security-advisories@github.com
Patch
🔗
https://github.com/froxlor/froxlor/releases/tag/2.3.5
security-advisories@github.com
Product
Release Notes
🔗
https://github.com/froxlor/froxlor/security/advisories/GHSA-x6w6-2xwp-3jh6
security-advisories@github.com
Exploit
Vendor Advisory
📦 Affected Products / CPE 1 entries
froxlor:froxlor