Froxlor’s DomainZones.add API accepts DNS record content without sanitizing for several record types, such as LOC, RP, SSHFP, and TLSA. An attacker can embed newlines and BIND zone directives, for example $INCLUDE, into the content field. When the periodic DNS rebuild cron job writes the zone file to disk, the injected directives are executed, allowing malicious alteration of the zone file or execution of arbitrary code under the privileges of the DNS service.

The vulnerability affects all installations of Froxlor prior to version 2.3.5 that expose the DomainZones.add endpoint to customers with DNS enabled. Any unpatched server where users can add DNS records through this API is at risk.

With a CVSS base score of 8.6, the flaw is high severity, but the EPSS score is below 1 % and it is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation in the wild. An attacker needs only API access to inject the malicious content; the cron job that rebuilds the zone file will then persist the injection, giving the attacker the ability to modify DNS responses or execute code. The attack vector is stored injection via the customer-facing API.