Junglewise Threat Intelligence

tinfoil-factory netfoil protection mechanism failure in DNS block responses

Severity: high · CVSS 7.4 · Published 2026-07-29

Executive brief

netfoil, a DNS filtering tool, incorrectly handles blocked web addresses by directing traffic to the local computer instead of dropping it. On Linux systems, this could allow malicious actors to trick a user's device into sending sensitive data to internal services that were supposed to be private. The actual risk depends on what other software is running on the affected machine and how its firewall is configured.

Technical details

A protection mechanism failure exists in netfoil's DNS proxy component where blocked domains are resolved to the IP address 0.0.0.0. On Linux, the target platform, the networking stack interprets 0.0.0.0 as the local interface (localhost) rather than an invalid or null route. An attacker could potentially leverage this to route traffic intended for a blocked external domain to sensitive local services. The vulnerability is rooted in the `dns_proxy.go` worker process and was addressed by switching the block response type to NXDOMAIN. This issue is fixed in version 0.4.0.

Affected products

  • tinfoil-factory netfoil < 0.4.0

Timeline

  • 2026-06-08: patched: Version 0.4.0 released
  • 2026-06-08: disclosed: Initial advisory publication by maintainer
  • 2026-07-29: advisory: GitHub Advisory Database review and publication

References

Related threats