PT-2024-12138 · Dragonfly · Dragonfly

Cokebeer · Published 2024-09-19 · Updated 2024-12-20 · CVE-2023-27584

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.0.9

Description The issue concerns Dragonfly, an open-source P2P-based file distribution and image acceleration system. It uses JWT to verify users, but the secret key for JWT is hardcoded, leading to authentication bypass. An attacker can perform any action as a user with admin privileges.

Recommendations For versions prior to 2.0.9, upgrade to version 2.0.9 to fix the issue. As a temporary workaround, consider restricting access to sensitive features or functions that rely on the hardcoded JWT secret key until the upgrade is applied.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2023-27584

GHSA-HPC8-7WPM-889W

GO-2024-3136

Affected Products

Dragonfly

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27584.json · Exploit
• 🔥 https://github.com/dragonflyoss/Dragonfly2/security/advisories/GHSA-hpc8-7wpm-889w · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27584 · Security Note
• https://osv.dev/vulnerability/GO-2024-3136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27584 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpc8-7wpm-889w · Vendor Advisory
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-hpc8-7wpm-889w · Note
• https://github.com/dragonflyoss/dragonfly/commit/684469a31bd27d38c715c507bca9f6d2c21f9007 · Note
• https://github.com/dragonflyoss/Dragonfly2/releases/tag/v2.0.9 · Note
• https://github.com/dragonflyoss/Dragonfly2 · Note
• https://github.com/dragonflyoss/Dragonfly2/commit/e9da69dc4048bf2a18a671be94616d85e3429433 · Note
• https://twitter.com/VulmonFeeds/status/1837057426329092247 · Twitter Post
• https://twitter.com/CVEnew/status/1836907167150133479 · Twitter Post
• https://twitter.com/cracbot/status/1838458413254349211 · Twitter Post
• https://twitter.com/Dinosn/status/1838044566936596703 · Twitter Post