CVE-2023-27584 - CVE House

Back to Database

Status published Critical CVE-2023-27584

Dragonfly2 vulnerable to hard coded cyptographic key

9.8 CVSS

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-27584

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →

Dragonfly tiny file download uses hard coded HTTP protocol

Dragonfly has weak integrity checks for downloaded files

Manager generates mTLS certificates for arbitrary IP addresses

Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Affected Vendor

dragonflyoss

View all reports →

Affected Software

Dragonfly2

Vulnerable Versions:

< 2.0.9

Timeline

Official Publish: September 19th, 2024

Last Modified: September 26th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1552 Unsecured Credentials

Credential Access

T1040 Network Sniffing

Credential Access

T1537 Transfer Data to Cloud Account

Credential Access

T1078 Valid Accounts

T1041 Exfiltration Over C2 Channel