Dragonfly server-side request forgery vulnerability

Vulnerability

Overview

Dragonfly, an open-source P2P-based file distribution and image acceleration system, contains multiple server-side request forgery vulnerabilities in versions prior to 2.1.0 [1][3]. The core issue is that the Manager API accepts a user-supplied URL when creating a Preheat job with weak validation, allowing an attacker to force the Manager to send HTTP requests to internal services that are otherwise not accessible [3]. Additionally, peers can trigger other peers to fetch an arbitrary URL through the pieceManager.DownloadSource method, and internal HTTP clients follow redirects, enabling a request to a malicious server to be redirected to internal services [1][3].

Exploitation

An attacker can exploit this vulnerability by providing a malicious URL when creating a Preheat job via the Manager API [3]. The URL is weakly validated, so the attacker can specify an internal IP address or hostname to probe or access internal HTTP endpoints [1]. Furthermore, a peer can ask another peer to make a request to an arbitrary URL by triggering the pieceManager.DownloadSource method, which calls httpSourceClient.GetMetadata and performs the request [3]. Because HTTP clients do not disable support for redirects, a request to a malicious server can be redirected to an internal service, expanding the attack surface [3].

Impact

Successful exploitation allows an attacker to probe or access internal HTTP endpoints that are not normally accessible from outside the network [1]. This can lead to information disclosure, further lateral movement, or compromise of internal service compromise depending on the internal services exposed [3].

Mitigation

The vulnerability is fixed in Dragonfly version 2.1.0 [1][3]. There are no effective workarounds beyond upgrading to the patched version [3]. Users should upgrade as soon as possible to mitigate the risk.