frxlor DNS Zone File Injection Bypass via Incomplete Validation (CVE-2026-30932)

Vulnerability Overview CVE-2026-30932 is an incomplete fix vulnerability in frxlor. This vulnerability involves issues with the validation of DNS record content, specifically manifested as: LOC Record Regular Expression: Uses to match newline characters (allowing embedded newlines); TLSA matching type lacks an upper bound on hex data length; all validators return unescaped input without performing zone file escaping. Impact: Attackers can inject arbitrary DNS records into the bind9 zone file, enabling domain hijacking, phishing, or DNS amplification attacks. Scope of Impact Affected Versions: All pre-fix versions of frxlor (= 2.3.7. Remediation Replace Regular Expression: Replace in LOC records with to exclude newline characters. Add Maximum Length Limit: Add a maximum length limit for the data of TLSA matching type . Escape Newline Characters: Escape newline characters before writing any DNS record content to the zone file. POC Code ```python #!/usr/bin/env python3 """ CVE-2026-30932 - Incomplete DNS Record Content Validation in frxlor/frxlor Affected component: Lib/Froxlor/Api/Commands/DomainZones.php Vulnerability type: Input Validation / DNS Zone File Injection Patch: https://github.com/frxlor/frxlor/commit/e3482920c32618e37f6a1eab4260b277a88b The patch adds validation for LOC, RP, SSHFP, and TLSA DNS record types. However, the sanitization is incomplete: 1. PRE-FIX: No validation at all - arbitrary content stored as DNS records. 2. POST-FIX BYPASS: LOC regex \s+ matches newlines; TLSA matchingType=s allows unbounded hex data; validators return raw input without escaping. """ import re import sys import string def vulnerable_add_record(record_type, content): """Pre-fix: no validation for LOC, RP, SSHFP, TLSA.""" errors = [] if record_type in ('LOC', 'RP', 'SSHFP', 'TLSA'): pass return {"errors": errors, "content": content} def validate_dns_loc(inp): """Replicates Validate::validateDnsLoc from the patch.""" pattern = re.compile( r'^' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'([NSEW])\s+' r'(\d{1,3})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+' r'(\d{1,2})\s+'

Goal Reached Thanks to every supporter — we hit 100%!

frxlor DNS Zone File Injection Bypass via Incomplete Validation (CVE-2026-30932)

More from this source