Attack Chain

1. Attacker gains access to a Froxlor customer account with DNS management enabled.
2. The attacker crafts a malicious API request to the DomainZones.add endpoint.
3. The API request includes a DNS record type (LOC, RP, SSHFP, TLSA) and a content field containing injected BIND directives, such as $INCLUDE /etc/passwd.
4. The Froxlor application writes the unsanitized content directly into the BIND zone file via DnsEntry::__toString().
5. The DNS rebuild cron job runs, processing the modified zone file.
6. BIND attempts to parse the injected directives, such as including /etc/passwd as zone data.
7. The attacker uses the DomainZones.get API or web UI to view the zone file and extract sensitive information or confirms service disruption.
8. Successful exploitation leads to information disclosure, DNS service disruption, or zone data manipulation.

Impact

Successful exploitation of this vulnerability can have significant consequences. Information disclosure allows attackers to read world-readable files on the server, potentially exposing sensitive data. DNS service disruption can occur if the injected content causes BIND to fail to load the zone, leading to downtime for affected domains. Furthermore, attackers can manipulate zone data by injecting arbitrary DNS records, potentially redirecting traffic or causing other malicious activities. The vulnerability affects Froxlor versions 2.3.4 and earlier.

Recommendation

• Apply the patch or upgrade to a version of Froxlor greater than 2.3.4 to remediate CVE-2026-30932, which addresses the input validation issue.
• Deploy the Sigma rule "Detect Froxlor BIND Zone File Injection Attempts" to identify suspicious API requests targeting the DomainZones.add endpoint (rules).
• Monitor web server logs for POST requests to /api.php with command: DomainZones.add and suspicious characters or BIND directives in the params field to detect exploitation attempts (webserver).