Dalfox is an open-source XSS scanner that, before version 2.13.0, improperly handled the output, output-all, and debug fields in its REST API server mode. These fields are JSON-tagged and deserialized directly from the attacker's request body, then used as file paths for logging scan results. The logger opens the attacker-supplied path with append and write flags, enabling file creation or modification outside intended usage. This file write operation occurs even in server/library mode where file output was not intended, and no API key is required by default, allowing unauthenticated attackers to write to arbitrary files writable by the dalfox process. The vulnerability is addressed in dalfox 2.13.0.

An unauthenticated remote attacker can exploit this vulnerability to write or append arbitrary data to files on the host filesystem with the permissions of the dalfox process. This can lead to unauthorized file modification, potential data corruption, or other impacts related to arbitrary file writes. Confidentiality is not impacted, but integrity is highly impacted. Availability impact is low.

This vulnerability is fixed in dalfox version 2.13.0. Users should upgrade to version 2.13.0 or later to remediate this issue. Since no official patch link or vendor advisory is provided, verify the upgrade from the official hahwul dalfox repository or release notes. Until upgraded, restrict network access to the dalfox REST API server to trusted users only.