https://vulnerability.circl.lu/sightings/feed 2026-08-06T07:52:42.361888+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/398a3037-0aaa-49b1-86f4-b247d26e83e7/export 2026-08-06T07:52:42.371238+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "398a3037-0aaa-49b1-86f4-b247d26e83e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xvg2-cgv6-6h7v", "type": "seen", "source": "https://gist.github.com/alon710/4f3175144e6d12e46b24b49c3b567546", "content": "# GHSA-XVG2-CGV6-6H7V: GHSA-XVG2-CGV6-6H7V: Local Traffic Interception and Information Disclosure via Improper DNS Block Responses in netfoil\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/GHSA-XVG2-CGV6-6H7V\n\n## Summary\nA protection mechanism failure in the netfoil DNS proxy prior to version 0.4.0 causes blocked domains to resolve to null IP addresses (0.0.0.0 or ::) with a NOERROR status instead of NXDOMAIN. On Linux systems, connections to these addresses are routed to the loopback interface (localhost), allowing local processes to intercept sensitive HTTP traffic, including authorization headers and session cookies, intended for the blocked domains.\n\n## TL;DR\nnetfoil DNS proxy returned 0.0.0.0 (NOERROR) for blocked domains, causing Linux systems to route traffic to localhost where local services could intercept credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693\n- **Attack Vector**: Network\n- **CVSS v4.0**: 7.4\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Linux installations utilizing netfoil DNS proxy\n- Containers and platforms running applications that compromise netfoil filtering\n- **netfoil**: < 0.4.0 (Fixed in: `v0.4.0`)\n\n## Mitigation\n\n- Upgrade netfoil dependency to v0.4.0 or newer\n- Configure local firewall rules to drop outbound traffic targeting 0.0.0.0 and ::\n- Avoid running unauthorized listener services on sensitive local ports (80, 443, 8080)\n\n**Remediation Steps:**\n1. Identify installations of netfoil in Go dependency trees or system services.\n2. Update the go.mod requirement for github.com/tinfoil-factory/netfoil to v0.4.0.\n3. Rebuild and redeploy the netfoil service.\n4. Verify the fix by performing a DNS query against a blocked domain and confirming an NXDOMAIN status is returned.\n\n## References\n\n- [GHSA-XVG2-CGV6-6H7V: Local traffic interception in netfoil](https://github.com/advisories/GHSA-xvg2-cgv6-6h7v)\n- [Official Advisory Page on Repository](https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v)\n- [Fix Pull Request #33](https://github.com/tinfoil-factory/netfoil/pull/33)\n- [Fix Commit Diff](https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448)\n- [v0.4.0 Release Page](https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-XVG2-CGV6-6H7V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T00:01:11.161381Z"} 2026-07-30T00:01:11.161381+00:00 https://vulnerability.circl.lu/sighting/e337b282-672e-4c7a-93b6-aefc72f756c4/export 2026-08-06T07:52:42.373649+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e337b282-672e-4c7a-93b6-aefc72f756c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xvg2-cgv6-6h7v", "type": "seen", "source": "https://gist.github.com/alon710/4f3175144e6d12e46b24b49c3b567546", "content": "# GHSA-XVG2-CGV6-6H7V: GHSA-XVG2-CGV6-6H7V: Local Traffic Interception and Information Disclosure via Improper DNS Block Responses in netfoil\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/GHSA-XVG2-CGV6-6H7V\n\n## Summary\nA protection mechanism failure in the netfoil DNS proxy prior to version 0.4.0 causes blocked domains to resolve to null IP addresses (0.0.0.0 or ::) with a NOERROR status instead of NXDOMAIN. On Linux systems, connections to these addresses are routed to the loopback interface (localhost), allowing local processes to intercept sensitive HTTP traffic, including authorization headers and session cookies, intended for the blocked domains.\n\n## TL;DR\nnetfoil DNS proxy returned 0.0.0.0 (NOERROR) for blocked domains, causing Linux systems to route traffic to localhost where local services could intercept credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-693\n- **Attack Vector**: Network\n- **CVSS v4.0**: 7.4\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Linux installations utilizing netfoil DNS proxy\n- Containers and platforms running applications that compromise netfoil filtering\n- **netfoil**: < 0.4.0 (Fixed in: `v0.4.0`)\n\n## Mitigation\n\n- Upgrade netfoil dependency to v0.4.0 or newer\n- Configure local firewall rules to drop outbound traffic targeting 0.0.0.0 and ::\n- Avoid running unauthorized listener services on sensitive local ports (80, 443, 8080)\n\n**Remediation Steps:**\n1. Identify installations of netfoil in Go dependency trees or system services.\n2. Update the go.mod requirement for github.com/tinfoil-factory/netfoil to v0.4.0.\n3. Rebuild and redeploy the netfoil service.\n4. Verify the fix by performing a DNS query against a blocked domain and confirming an NXDOMAIN status is returned.\n\n## References\n\n- [GHSA-XVG2-CGV6-6H7V: Local traffic interception in netfoil](https://github.com/advisories/GHSA-xvg2-cgv6-6h7v)\n- [Official Advisory Page on Repository](https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-xvg2-cgv6-6h7v)\n- [Fix Pull Request #33](https://github.com/tinfoil-factory/netfoil/pull/33)\n- [Fix Commit Diff](https://github.com/tinfoil-factory/netfoil/commit/891d3513c77999a9deef9f23506807d9653ee448)\n- [v0.4.0 Release Page](https://github.com/tinfoil-factory/netfoil/releases/tag/v0.4.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-XVG2-CGV6-6H7V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T22:32:10.693011Z"} 2026-07-29T22:32:10.693011+00:00