Attack Chain

1. Attacker sends a POST request to the /scan endpoint of the Dalfox REST API server (typically running on 0.0.0.0:6664).
2. The request includes a JSON body with the url, options, custom-payload-file, skip-discovery, and param fields set.
3. The custom-payload-file field contains the path to the file the attacker wants to read (e.g., /etc/hostname).
4. The skip-discovery option is set to true, and param is set to ["q"] to bypass checks.
5. Dalfox reads the specified file line by line using voltFile.ReadLinesOrLiteral.
6. Each line of the file is embedded as the value of the q query parameter in a GET request to the attacker-controlled URL.
7. Dalfox sends the HTTP GET request to the attacker’s server, exfiltrating one line of the file.
8. The attacker receives the file content via the query parameter of the HTTP GET request.

Impact

Successful exploitation allows an attacker to read arbitrary files on the Dalfox host that the Dalfox process has access to. This includes sensitive data like SSH private keys, TLS certificates, .env files containing credentials, cloud credential files, and system configuration files. If combined with other vulnerabilities, such as the found-action RCE, the attacker could potentially gain full control of the server.

Recommendation

• Implement the preferred remediation: Apply a denylist of fields that should never be accepted from the REST API, as suggested in the source, to prevent attackers from abusing CustomPayloadFile and other sensitive parameters.
• Require the --api-key flag at server startup, as suggested in the source, to mandate authentication for all API requests.
• Deploy the Sigma rule Detect Dalfox Unauthenticated File Read via API to detect attempts to exploit this vulnerability by monitoring HTTP POST requests to the /scan endpoint with a custom-payload-file parameter.