N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-84g5-x8j3-7235

GHSA-84g5-x8j3-7235: Netfoil has incorrect allowlist enforcement

Summary

Rules could be bypassed by changing the first character: example.com could be be bypassed by e.g. fxample.com.

Details

Off-by-one error in the suffixtrie implementation.

Impact

The domain filter could be bypassed. Please note that DNS filtering alone is not enough to block malicious traffic.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-84g5-x8j3-7235

GHSA-84g5-x8j3-7235:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/tinfoil-factory/netfoil	go	< 0.2.1	0.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an off-by-one error in the suffixtrie implementation of the netfoil library. Specifically, the Insert and MatchExact functions in suffixtrie/suffixtrie.go contained a loop that iterated from len(word) - 1 down to 1, effectively skipping the first character (at index 0) of the input word. When a domain like 'example.com' was inserted into the filter, it was stored as if it were 'xample.com'. Consequently, when checking a domain, MatchExact would also ignore the first character. This allowed a malicious actor to bypass the filter by using a domain like 'fxample.com', as it would be compared as 'xample.com', matching the incorrectly stored entry for 'example.com'. The patch corrects the loop condition to i >= 0, ensuring the entire domain is processed. Additionally, a logic error in MatchSuffix that incorrectly handled empty strings was also fixed.

Vulnerable functions

suffixtrie.Node.Insert

suffixtrie/suffixtrie.go

The function had an off-by-one error in its loop, which caused it to skip the first character of the word being inserted into the suffix trie. This corrupted the data structure used for filtering.

suffixtrie.Node.MatchExact

suffixtrie/suffixtrie.go

The function had an off-by-one error in its loop, which caused it to skip the first character of the word during an exact match. This allowed an attacker to bypass the filter by providing a domain with a modified first character (e.g., 'fxample.com' instead of 'example.com').

suffixtrie.Node.MatchSuffix

suffixtrie/suffixtrie.go

The function incorrectly returned true for an empty string, which could lead to incorrect suffix matching behavior. While the primary vulnerability was the off-by-one error, this fix was also part of the security patch.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.