Dragonfly vulnerabilities

In Dragonfly prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult. These values are copied into resource.Host, and Peer.DownloadTinyFile() builds an HTTP GET request without destination validation, allowing read SSRF against loopback, link-local, and private services. DownPort is restricted to 1024-65534, and up to 128 bytes of the response can be placed in Task.DirectPiece.

Dragonfly prior to 2.4.4 registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while the handler returns models.Oauth records with client_secret exposed in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can retrieve the provider's client secret, client identifier, and redirect URL.

Dragonfly before version 1.40.0 has a vulnerability in CMS.INITBYDIM and CMS.INITBYPROW commands where an arithmetic overflow in buffer size calculation leads to undersized buffer allocation. This allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server.