Executive brief
Dalfox, a tool used for scanning websites for security vulnerabilities, contains a flaw in its server mode that allows unauthorized users to read sensitive files from the host machine. By sending a specially crafted request to the Dalfox API, an attacker can force the server to read local files (such as passwords or private keys) and send their contents to an external server. This could lead to a full compromise of the server hosting the Dalfox instance.
Technical details
Dalfox's REST API server mode fails to authenticate requests by default and lacks sanitization for the 'custom-payload-file' field in the scan options. An attacker can provide an arbitrary local file path in a POST request to the /scan endpoint. The application's scan engine reads this file line-by-line and embeds the content as XSS payloads in outbound HTTP requests directed at an attacker-controlled URL. This effectively exfiltrates the file's contents via query parameters. The vulnerability is rooted in 'pkg/server/server.go' and 'pkg/scanning/scan.go', where user-supplied options are passed directly to file-reading functions without validation or privilege checks. Version 2.13.0 addresses this by requiring an API key and stripping dangerous fields from API-sourced requests.
Affected products
- hahwul dalfox <= 2.12.0
Timeline
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-12: disclosed: Vulnerability disclosed via GHSA-35wr-x7v6-9fv2
- 2026-06-08: other: Advisory updated