Dragonfly Manager makes requests to external endpoints with disabled TLS authentication

Vulnerability

Overview

In Dragonfly versions prior to 2.1.0, the Manager component disables TLS certificate verification in its HTTP clients (see code in getAuthToken). The tls.Config is set with InsecureSkipVerify: true, and the clients are not configurable, so users cannot re-enable verification [1][4]. This means the Manager will accept any TLS certificate, including self-signed or malicious ones, when making HTTP requests.

Exploitation

An adversary with network-level access (i.e., in a position to perform a Man-in-the-Middle attack) can intercept traffic between the Manager and external endpoints. Since the Manager processes dozens of preheat jobs, the attacker can supply invalid data to the Manager. The Manager will trust this data because TLS verification is disabled [1][4].

Impact

By feeding the Manager incorrect data, an attacker can cause the system to preheat with the wrong content. This leads to denial of service (e.g., unavailable or incorrect artifacts) and file integrity problems, as the system distributes corrupted or unexpected files to peers [1][4].

Mitigation

The vulnerability is fixed in Dragonfly v2.1.0. No effective workarounds exist beyond upgrading to the patched version [4]. Users should update their deployments to at least 2.1.0 to eliminate the risk of MitM attacks exploiting this TLS verification weakness.