Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file
Summary
When dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine. The engine passes the value to voltFile.ReadLinesOrLiteral, which reads lines from any file path accessible to the dalfox process and embeds each line as an XSS payload in outbound HTTP requests directed at the attacker-controlled target URL. Because the server has no API key by default, an unauthenticated network attacker can exfiltrate the contents of arbitrary files on the dalfox host by reading them line-by-line through scan traffic.
Severity
High (CVSS 3.1: 7.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector: Network — server binds to
0.0.0.0:6664 by default; reachable by any network peer. - Attack Complexity: Low — no preconditions beyond network access;
skip-discovery and param are both attacker-supplied, so the code path is fully under attacker control. - Privileges Required: None —
--api-key defaults to "", so the auth middleware is not registered. - User Interaction: None.
- Scope: Unchanged — the file read and the outbound HTTP exfiltration request both originate from the same dalfox process authority.
- Confidentiality Impact: High — the attacker can read any file the dalfox process can open: private keys, configuration files containing database credentials, environment files,
/etc/passwd, etc. - Integrity Impact: None — this path is read-only.
- Availability Impact: None.
Affected Component
cmd/server.go — init() (line 51): --api-key defaults to "" — no auth by defaultpkg/server/server.go — setupEchoServer() (line 68): auth middleware only registered when APIKey != ""pkg/server/server.go — postScanHandler() (lines 173–191): rq.Options (including CustomPayloadFile) passed to ScanFromAPI without sanitizationlib/func.go — Initialize() (line 117): CustomPayloadFile explicitly propagated from caller optionspkg/scanning/scan.go — anonymous block (lines 341–368): voltFile.ReadLinesOrLiteral(options.CustomPayloadFile) reads file; contents injected into outbound requests
CWE
- CWE-306: Missing Authentication for Critical Function
- CWE-73: External Control of File Name or Path
- CWE-552: Files or Directories Accessible to External Parties
Description
custom-payload-file Is Fully Attacker-Controlled
model.Options exposes CustomPayloadFile with a JSON tag:
```go
// pkg/model/options.go:33
CustomPayloadFile string json:"custom-payload-file,omitempty"
```
postScanHandler binds the entire Req.Options from the JSON body and passes it directly to ScanFromAPI:
```go
// pkg/server/server.go:173-191
rq := new(Req)
if err := c.Bind(rq); err != nil { ... }
go ScanFromAPI(rq.URL, rq.Options, *options, sid)
```
ScanFromAPI passes rqOptions as target.Options to dalfox.Initialize:
```go
// pkg/server/scan.go:22-27
target := dalfox.Target{
URL: url,
Method: rqOptions.Method,
Options: rqOptions,
}
newOptions := dalfox.Initialize(target, target.Options)
```
Initialize explicitly copies CustomPayloadFile into newOptions with no filtering:
```go
// lib/func.go:117
"CustomPayloadFile": {&newOptions.CustomPayloadFile, options.CustomPayloadFile},
```
File Read and Exfiltration Path
In pkg/scanning/scan.go, when the scan engine reaches the custom payload phase, it reads the attacker-specified file path:
```go
// pkg/scanning/scan.go:341-366
if (options.SkipDiscovery || utils.IsAllowType(policy["Content-Type"])) && options.CustomPayloadFile != "" {
ff, err := voltFile.ReadLinesOrLiteral(options.CustomPayloadFile)
if err != nil {
printing.DalLog("SYSTEM", "Failed to load custom XSS payload file", options)
} else {
for _, customPayload := range ff {
if customPayload != "" {
for k, v := range params {
if optimization.CheckInspectionParam(options, k) {
...
tq, tm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", encoder, options)
query[tq] = tm
}
}
}
}
}
}
```
Each line of the file becomes a payload value embedded in a query parameter of an HTTP request sent to the attacker-controlled target URL. performScanning then dispatches every entry in the query map via SendReq, delivering the file's contents to the attacker's server as the value of the nominated parameter (e.g., ?q=<file-line>).
Condition Is Trivially Satisfiable
The condition `options.SkipDiscovery || utils.IsAllowType(policy["Content-Type
