GHSA-XVG2-CGV6-6H7V: Local Traffic Interception and Information Disclosure via Improper DNS Block Responses in netfoil

Vulnerability ID: GHSA-XVG2-CGV6-6H7V
CVSS Score: 7.4
Published: 2026-07-29

A protection mechanism failure in the netfoil DNS proxy prior to version 0.4.0 causes blocked domains to resolve to null IP addresses (0.0.0.0 or ::) with a NOERROR status instead of NXDOMAIN. On Linux systems, connections to these addresses are routed to the loopback interface (localhost), allowing local processes to intercept sensitive HTTP traffic, including authorization headers and session cookies, intended for the blocked domains.

TL;DR

netfoil DNS proxy returned 0.0.0.0 (NOERROR) for blocked domains, causing Linux systems to route traffic to localhost where local services could intercept credentials.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-693
• Attack Vector: Network
• CVSS v4.0: 7.4
• Impact: High (Confidentiality & Integrity)
• Exploit Status: Proof of Concept (PoC) available
• KEV Status: Not Listed

Affected Systems

• Linux installations utilizing netfoil DNS proxy
• Containers and platforms running applications that compromise netfoil filtering
• netfoil: < 0.4.0 (Fixed in: v0.4.0)

Code Analysis

Commit: 891d351

Use NXDOMAIN rather than 0.0.0.0 for block responses

Mitigation Strategies

• Upgrade netfoil dependency to v0.4.0 or newer
• Configure local firewall rules to drop outbound traffic targeting 0.0.0.0 and ::
• Avoid running unauthorized listener services on sensitive local ports (80, 443, 8080)

Remediation Steps:

1. Identify installations of netfoil in Go dependency trees or system services.
2. Update the go.mod requirement for github.com/tinfoil-factory/netfoil to v0.4.0.
3. Rebuild and redeploy the netfoil service.
4. Verify the fix by performing a DNS query against a blocked domain and confirming an NXDOMAIN status is returned.

References

• GHSA-XVG2-CGV6-6H7V: Local traffic interception in netfoil
• Official Advisory Page on Repository
• Fix Pull Request #33
• Fix Commit Diff
• v0.4.0 Release Page

Read the full report for GHSA-XVG2-CGV6-6H7V on our website for more details including interactive diagrams and full exploit analysis.