Listen to this Post
netfoil is a Go‑based DNS‑over‑HTTPS (DoH) proxy that resolves DNS queries over HTTPS to enhance privacy. To support advanced features like HTTP/3, it requests HTTPS Resource Records (RR) from the DoH server alongside the usual A/AAAA records. These HTTPS RRs contain an Application‑Layer Protocol Negotiation (APLN) field – a byte sequence that indicates which protocols the server supports.
The vulnerability arises because netfoil does not validate or sanitise the APLN data before writing it to its log files. When a DoH response arrives, the proxy extracts the APLN field and the single‑byte response code from the HTTPS RR and passes them directly to the logging function. No checks are performed to ensure that the APLN data contains only printable, safe characters or that it does not exceed a reasonable length. Consequently, an attacker who can control the DoH server (or who can spoof DoH responses) can inject arbitrary byte sequences – including carriage returns, line feeds, terminal escape codes, or extremely long strings – into the log stream.
This log injection can have several consequences. First, it allows an attacker to forge log entries, potentially hiding malicious activity or misleading administrators. Second, if the logs are consumed by downstream systems (e.g., SIEM or log parsers), the injected control characters can break log formats, corrupt data, or even trigger command execution if the logs are later fed into unsafe scripts. Third, the unbounded APLN data can cause excessive memory consumption because netfoil allocates buffers to hold the raw data before logging; repeated large responses may exhaust available memory and lead to denial of service. The single‑byte response code, though small, is also logged without validation, adding another vector for log pollution.
The root cause is a classic CWE‑117 (Improper Output Neutralization for Logs) combined with CWE‑400 (Uncontrolled Resource Consumption). The fix, released in netfoil v0.5.0, introduces proper sanitisation of the APLN field – stripping or escaping non‑printable characters and truncating overly long values – and ensures that the response code is logged in a safe, numeric format. Users are strongly advised to upgrade immediately, as the vulnerability is trivially exploitable by any attacker who can influence the DoH response data.
DailyCVE Form:
Platform: netfoil (Go)
Version: < 0.5.0
Vulnerability: Log injection + DoS
Severity: Low (CVSS 2.7)
Date: 2026-08-24
Prediction: Already patched in v0.5.0
What Undercode Say:
Analytics – demonstrating the unsafe logging behaviour
Simulate a malicious DoH response with a crafted HTTPS RR The APLN field contains a newline and a fake log entry curl -k -X POST https://malicious-doh.example/dns-query \ -H "Content-Type: application/dns-message" \ --data-binary @query.bin Expected log output (vulnerable version): [bash] DoH response: APLN=HTTP/2 [bash] DoH response: APLN=HTTP/3 [bash] DoH response: APLN=malicious [bash] DoH response: APLN=EVIL\n[bash] System compromised The injected line appears as a legitimate error log
// Excerpt from netfoil/dns.go (vulnerable code)
func handleDoHResponse(resp http.Response) {
// ...
apln := extractAPLN(resp) // raw bytes from HTTPS RR
log.Printf("DoH response: APLN=%s", apln) // UNSAFE
code := resp.StatusCode
log.Printf("Response code: %d", code)
}
Exploit: (Educational Purposes!)
- Set up a rogue DoH server that returns a valid DNS response but with an HTTPS RR containing an APLN field like
"EVIL\r\n[bash] Injection successful". - Configure netfoil to use this rogue server as its upstream DoH resolver.
- Trigger a DNS query that causes netfoil to request and log the HTTPS RR.
- Observe that the injected text appears verbatim in the log file, potentially breaking log parsers or hiding attacker actions.
Protection:
- Upgrade to netfoil v0.5.0 or later, which sanitises all loggable fields from DoH responses.
- If upgrading is not possible, implement a logging proxy or middleware that filters and escapes non‑printable characters before they reach the log file.
- Restrict network access to trusted DoH servers only, and validate the authenticity of DoH responses using DNSSEC or similar mechanisms to reduce the risk of spoofing.
- Monitor logs for anomalous control characters or unusually long entries, which may indicate an attempted exploitation.
Impact:
- Log Injection – Attackers can forge log entries, potentially concealing malicious activities or injecting false alarms.
- Denial of Service – Repeated large APLN values can exhaust memory, causing netfoil to crash or become unresponsive.
- Data Corruption – Log parsers that rely on structured formats (e.g., JSON, CSV) may fail when encountering unexpected control characters, leading to loss of log data.
- Reputation Damage – If logs are used for compliance or auditing, injected entries can undermine the integrity of the audit trail.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
