Directories created via os.MkdirAll are not checked for permissions

Vulnerability

Description

Dragonfly2, an open source P2P-based file distribution and image acceleration system, contains a vulnerability in how it creates directory paths. Prior to version 2.1.0, the system uses the os.MkdirAll function to create directories with specific permissions. However, os.MkdirAll does not check permissions on existing directories, so if a directory already exists, it retains its original permissions [1] [4].

Exploitation

A local attacker with unprivileged access to the machine can exploit this by monitoring the filesystem and pre-creating the directories that Dragonfly2 will later create, assigning them broad permissions (e.g., 0777). This race condition allows the attacker to control the directory's permissions before Dragonfly2 uses it [1] [4].

Impact

Once the directory is created with broad permissions, the attacker can delete or forge files within that directory, potentially altering the results of Dragonfly2 commands and tampering with file distribution or image acceleration processes. This could lead to data integrity issues or further compromise of the system [1] [4].

Mitigation

The vulnerability is fixed in Dragonfly2 version 2.1.0 and above. Users should upgrade to this version as there are no effective workarounds [1] [4].