tinfoil-factory/netfoil · Security
netfoil has a domain name filter bypass via multiple questions
- GHSA ID
- GHSA-59qp-cfj3-rp64
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.9 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Summary
Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate.
Impact
Depends on a local attackers ability to craft multiple questions and the remote DoH server supporting them.
CWEs
- CWE-436 · Interpretation Conflict
- CWE-693 · Protection Mechanism Failure