Timing attacks against Proxy’s basic authentication are possible

Vulnerability

Overview

CVE-2025-59350 affects Dragonfly, an open-source P2P-based file distribution and image acceleration system. The vulnerability resides in the access control mechanism for the Proxy feature, which uses simple string comparisons are used to validate passwords. This design is susceptible to timing attacks, where an attacker can infer the correct password one character at a time by measuring the execution time of comparison operations [1][2].

Exploitation

An attacker with network access to the Proxy endpoint can send crafted authentication requests. By systematically varying each character of the password and observing response timing differences, the attacker can deduce the correct password incrementally. No prior authentication is required, and the attack prerequisites include only network connectivity to the vulnerable service [1][4].

Impact

Successful exploitation allows the attacker to bypass the Proxy's authentication, gaining unauthorized access to the Proxy feature. This could lead to further compromise of the Dragonfly system, including potential data exfiltration or disruption of file distribution services [1][3].

Mitigation

The vulnerability is fixed in Dragonfly version 2.1.0. Users are strongly advised to upgrade to this version or later. No workarounds are documented, and the issue is tracked in the Go vulnerability database as GO-2025-3972 [1][4].