Executive brief
Dalfox, a tool used for scanning web applications for vulnerabilities, is susceptible to a remote crash when running in its server (REST API) mode. An unauthenticated attacker can send a specially crafted scan request that causes the Dalfox process to terminate immediately due to an internal programming error. This results in a total loss of availability for the scanning service and requires a manual restart to restore operations.
Technical details
A structural ordering bug in 'pkg/scanning/parameterAnalysis.go' causes a Go runtime panic when the application is running in server mode. The 'ParameterAnalysis' function utilizes a two-stage worker process sharing a single 'results' channel. The channel is closed after the first stage (URL parameter processing) completes, but is subsequently reused by the second stage (POST-body parameter processing). If a parameter is reflected during the second stage, the 'processParams' function attempts to send data to the already-closed channel, triggering a panic that crashes the entire process. This is exploitable remotely without authentication because the REST API defaults to no API key and the attacker can control the 'data' field and target URL to trigger the reflection condition.
Affected products
- hahwul dalfox <= 1.2.2
- hahwul dalfox/v2 <= 2.12.0
Timeline
- 2026-05-07: disclosed: Initial disclosure of the vulnerability.
- 2026-05-12: advisory: GHSA-2g4x-fq3j-cgq4 published.
References
- https://api.github.com/users/bugbunny-research
- https://github.com/bugbunny-research
- https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D
- https://api.github.com/users/bugbunny-research/repos
- https://avatars.githubusercontent.com/u/262839898?v=4
- https://api.github.com/users/bugbunny-research/events%7B/privacy%7D