Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in ParameterAnalysis (server mode)
Summary
ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes (close(results) at line 438), but the second stage — which processes POST-body parameters (dp) — is then launched with the same already-closed channel as its output. When a scanned parameter is reflected, processParams executes results <- paramResult on the closed channel, triggering a Go runtime panic that crashes the entire dalfox process. In server mode, the crash is remotely triggerable by any unauthenticated caller who can reach the REST API, because the default configuration has no API key and the second stage activates whenever options.Data != "" (i.e., the attacker supplies the data field) and the target reflects at least one parameter.
Severity
High (CVSS 3.1: 7.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack Vector: Network — server binds to
0.0.0.0:6664 by default; reachable by any network peer. - Attack Complexity: Low — the attacker controls both trigger conditions: the
data field that populates the second stage's work queue, and the target URL they point at a reflective server they control. - Privileges Required: None —
--api-key defaults to "", so no auth middleware is registered. - User Interaction: None.
- Scope: Unchanged — a goroutine panic without a
recover terminates the entire Go process; the impact stays within the dalfox process authority. - Confidentiality Impact: None.
- Integrity Impact: None.
- Availability Impact: High — the entire dalfox server process crashes, requiring manual restart. A single well-timed request is sufficient.
Note on PR #917: Commit 8a424d1 (fix: resolve data race and nil pointer panic in processParams) fixed two concurrent-safety bugs in processParams — a data race on paramResult.Chars and a nil pointer dereference on resp.Header. It did not fix the closed-channel panic reported here, which is a structural ordering bug in ParameterAnalysis itself, not inside processParams.
Affected Component
pkg/scanning/parameterAnalysis.go — ParameterAnalysis() (lines 436–448): results channel closed at line 438, then passed to second-stage processParams workers at line 445pkg/scanning/parameterAnalysis.go — processParams() (line 299): results <- paramResult panics when results is closed
CWE
- CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization ('Race Condition') — channel lifecycle ordering error
- CWE-404: Improper Resource Shutdown or Release
Description
Two-Stage Channel Lifecycle Ordering Error
ParameterAnalysis allocates a single results channel shared by both worker stages:
```go
// pkg/scanning/parameterAnalysis.go:397-408
paramsQue := make(chan string, concurrency)
results := make(chan model.ParamResult, concurrency) // ← single channel for both stages
go func() {
for result := range results { // consumer exits when results is closed
mutex.Lock()
params[result.Name] = result
mutex.Unlock()
}
}()
```
First stage (URL parameters in p):
```go
// lines 410-437
for i := 0; i < concurrency; i++ {
wgg.Add(1)
go func() {
processParams(target, paramsQue, results, options, rl, miningCheckerLine, pLog)
wgg.Done()
}()
}
// ... feed paramsQue ...
close(paramsQue)
wgg.Wait()
close(results) // ← line 438: results is now closed; consumer goroutine exits
```
Second stage (POST-body parameters in dp):
```go
// lines 440-448
var wggg sync.WaitGroup
paramsDataQue := make(chan string, concurrency)
for j := 0; j < concurrency; j++ {
wggg.Add(1)
go func() {
processParams(target, paramsDataQue, results, options, rl, miningCheckerLine, pLog)
// ^^^^^^^ — same closed channel
wggg.Done()
}()
}
```
When a second-stage worker finds a reflected parameter, processParams sends to the closed channel:
```go
// pkg/scanning/parameterAnalysis.go:299
results <- paramResult // panic: send on closed channel
```
A Go runtime panic in a goroutine without a recover terminates the entire program. In server mode, this kills the dalfox API server process.
Trigger Conditions Are Both Attacker-Controlled
Condition 1 — dp is non-empty: dp (the POST-body parameter map) is populated in addParamsFromWordlist → setP whenever options.Data != "":
```go
// parameterAnalysis.go:41-45
if options.Data != "" {
if dp.Get(name) == "" {
dp.Set(name, "")
}
}
```
The attacker sets "data": "q=test" in the JSON body, which propagates through Initialize (lib/func.go:106). With "mining-dict": true, the entire GF-XSS wordlist (hundre
