Manager generates mTLS certificates for arbitrary IP addresses

Vulnerability

Overview

CVE-2025-59353 is a critical authentication bypass vulnerability in Dragonfly, an open-source P2P file distribution and image acceleration system. Prior to version 2.1.0, the Manager's Certificate gRPC service fails to verify whether the IP addresses requested in a certificate signing request (CSR) actually belong to the peer making the request [1][4]. The code contains a TODO comment indicating that IP validation was never implemented, and the service only checks the CSR signature without verifying that the requested IPs match the peer's connection address [4].

Exploitation

An attacker can exploit this by connecting to the Manager and submitting a CSR that includes arbitrary IP addresses. The service will issue a valid TLS certificate for those IPs, regardless of whether the attacker controls them [1][4]. The vulnerability is present in the certificate generation logic, where the peer's connected IP is parsed but only used as a fallback if the CSR contains no IP addresses [4].

Impact

Successful exploitation allows a malicious peer to obtain valid mTLS certificates for any IP address, effectively bypassing mutual TLS authentication. This undermines the security of the entire Dragonfly cluster, enabling an attacker to impersonate other peers or services, intercept traffic, and perform man-in-the-middle attacks [1][4].

Mitigation

The vulnerability is fixed in Dragonfly version 2.1.0 [1][4]. There are no effective workarounds effective workarounds beyond upgrading [4]. Users should update to the latest version immediately to restore mTLS integrity.