A critical CRLF injection vulnerability in Froxlor allows authenticated users to manipulate DNS zone files, potentially leading to unauthorized DNS redirection or service disruption.

This vulnerability involves improper neutralization of CRLF sequences (CWE-93) within the DomainZones::add function. An authenticated customer can bypass content validation to inject newline characters and arbitrary BIND directives into server configuration files.

The ability to inject arbitrary BIND directives into zone files poses a significant risk to the integrity of network services managed by Froxlor. An attacker could redirect traffic to malicious servers, facilitate man-in-the-middle attacks, or cause denial of service conditions by corrupting zone files. Given the CVSS score of 8.5, this high-severity flaw requires immediate attention to prevent unauthorized control over domain resolution.

Immediate Action: Update the Froxlor installation to version 2.3.6 or later to apply the necessary input sanitization and validation logic.

Proactive Monitoring: Review BIND zone files and server access logs for unexpected DNS record entries or unusual configuration directives that deviate from established provisioning patterns.

Compensating Controls: Implement strict input validation at the Web Application Firewall level to block requests containing newline or carriage return characters in DNS record fields until the patch can be applied.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to DNS integrity and server administration security. Administrators should prioritize updating to version 2.3.6 immediately to eliminate the injection path and prevent potential abuse of the BIND configuration process by authenticated users.