Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/tinfoil-factory/netfoil | go | < 0.3.0 | 0.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper handling of domain names before they are logged. The analysis of the patch between version v0.2.1 and v0.3.0 of tinfoil-factory/netfoil revealed two key functions that were modified to address this issue. The commit 8f62a949252b412826b73fb60c9e57cba4045166 specifically addresses the problem.
In dns/dns.go, the readDomain function was updated to validate domain labels against a regex, preventing the processing of invalid and potentially malicious domain names. Previously, it would accept any string as a valid domain part.
In dns/filter.go, the Policy.domainHasCorrectFormat function was changed to no longer include the domain name in the log message when a validation check fails. This prevents an attacker from injecting malicious strings into the logs via a crafted domain name.
These changes clearly indicate that both readDomain and Policy.domainHasCorrectFormat were vulnerable to log injection due to insufficient input validation and sanitization.
readDomaindns/dns.go
Policy.domainHasCorrectFormatdns/filter.go