CVE-2023-27584

The Dragonfly system uses JWT tokens to verify user identity. The secret key used to sign and verify these tokens is hard-coded in the application's source code. Since the key is known and immutable, an attacker can independently generate a properly signed JWT token with arbitrary privileges. As a result, the authentication mechanism can be completely bypassed without possessing any credentials.

A remote unauthenticated attacker can perform arbitrary actions with administrator privileges, leading to complete breach of confidentiality, integrity, and availability of the system.

Dragonfly2 should be immediately updated to version 2.0.9 or later. The manufacturer does not indicate any known workarounds for this vulnerability. Patch available at: https://github.com/dragonflyoss/Dragonfly2/releases/tag/v2.0.9

Dragonfly2 (dragonflyoss/Dragonfly2) — all versions before 2.0.9