Dalfox Found-Action Deserialization RCE

MetasploitMetasploit exploitExploitRubyexploit_linux/http/dalfox_server_rce_cve_2026_45087

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit exploit module that achieves remote code execution on Dalfox server <= 2.12.0 by injecting a payload into the 'found-action' option of a POST /scan request, which the server deserializes and executes when a scan finding is triggered.

Backdoor review

No backdoor observed in reviewed code

The Metasploit module exploits CVE-2026-45087 by sending a crafted JSON payload to the vulnerable dalfox server. The module's behavior is consistent with a standard Metasploit exploit: it sends the user-supplied payload to the target via the 'found-action' parameter. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwaredalfox
Attack typesremote code executioncommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that actively delivers a payload to achieve remote code execution. It includes check, primer, and exploit methods that send crafted HTTP requests to trigger the vulnerability and execute an attacker-supplied command.

modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:6modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:65-73modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:79-96modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:98-102

Requirements

  • Target must be running dalfox version <= 2.12.0 in REST API server mode (dalfox server) without an API key configured.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:19-20
  • Attacker must be able to reach the dalfox server port (default 6664).modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:20

Observed behavior

  • Sends a GET request to /swagger/index.html to detect the dalfox server.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:66-69
  • Starts an HTTP server to provide a URL that triggers a scan finding.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:10
  • Sends a POST request to /scan with a JSON body containing the encoded payload in the 'found-action' option and 'found-action-shell' set to 'bash'.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:80-94
  • The dalfox server deserializes the attacker-supplied options and executes the 'found-action' command when a scan finding occurs.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:21-23
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Sends user-supplied payload in 'found-action' JSON field to target serverThis is the core exploit mechanism for CVE-2026-45087, as described in the module metadata and CVE description.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:84-93
Http Server
Starts an HTTP server on SRVPORT 8081 to provide a URL for the scanThe module includes Msf::Exploit::Remote::HttpServer and uses get_uri to provide a URL for the dalfox scan, which is necessary to trigger the vulnerability.modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:10modules/exploits/linux/http/dalfox_server_rce_cve_2026_45087.rb:85
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module code was not executed; classification is based on static analysis of its stated purpose and logic.
  • Review is limited to the provided Metasploit module source code. The behavior of included Metasploit framework mixins (e.g., HttpClient, HttpServer) and the final encoded payload are not expanded or analyzed.
  • Binary files were not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1