Dragonfly tiny file download uses hard coded HTTP protocol

The vulnerability lies in the Dragonfly scheduler's DownloadTinyFile function, which hardcodes the HTTP scheme instead of HTTPS when constructing the download URL for tiny files [1]. This oversight means that the request is transmitted over unencrypted HTTP, making it susceptible to interception and modification by a network-level attacker.

An attacker positioned between the peer and the scheduler can perform a Man-in-the-Middle (MITM) attack, altering the download URL or the data in transit. The advisory notes that this attack is further facilitated by weak integrity checks (TOB-DF2-15), allowing modified data to go undetected [4]. The attacker does not need to join the peer-to-peer network; they only require network access to the communication path.

Successful exploitation allows the attacker to replace legitimate files with malicious ones. Unsuspecting peers then consume these tampered files, potentially leading to supply-chain compromise or other downstream impacts [4].

Dragonfly version 2.1.0 and above contain the fix, which changes the scheme to HTTPS for tiny file downloads. No effective workarounds exist beyond upgrading [4].