CVE-2026-54347

### Summary A stored Cross-Site Scripting (XSS) vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access (customer role) to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the payload executes automatically — enabling complete admin account takeover, credential theft, and full server compromise. --- ### Details Three code locations combine to create this vulnerability: **1. Input validation does not strip HTML special characters** — `lib/Froxlor/Api/Commands/DomainZones.php:158` ```php // Only strips non-printable chars. < and > (0x3C/0x3E) pass through unmodified. $content = preg_replace('/[^\x09\x20-\x7E]/', '', $content); $content = Dns::encloseTXTContent($content); // only wraps in quotes, no HTML encoding ``` **2. Display callback returns raw HTML without escaping** — `lib/Froxlor/UI/Callbacks/Text.php:95` ```php public static function wordwrap(array $attributes): string { return wordwrap($attributes['data'], 100, '<br>', true); // no htmlspecialchars() } ``` **3. Twig template renders the callback output with `|raw`** — `templates/Froxlor/table/table.html.twig:57` ```twig {% else %} {{ td.data|raw }} {# string from wordwrap() — rendered without escaping #} {% endif %} ``` The DNS editor table assigns `[Text::class, 'wordwrap']` as the callback for the `content` column (`lib/tablelisting/tablelisting.dns.php:58`). The callback returns a non-iterable string, so the template falls to the `|raw` branch. Additionally, the Content Security Policy header (`lib/Froxlor/UI/Panel/UI.php:140`) includes `'unsafe-inline'`, rendering CSP completely ineffective as a mitigation: ``` Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; ... ``` --- ### PoC <img width="2025" height="1144" alt="image" src="https://github.com/user-attachments/assets/f6808b24-c4b6-4bd2-9673-d7ddc4939794" /