CVE-2023-27584: dragonflyoss dragonfly2 Use of Hard-coded Cryptographic Key
Vulnerability summary
CVE-2023-27584 is a critical (CVSS 9.8) Use of Hard-coded Cryptographic Key vulnerability in dragonflyoss dragonfly2. EPSS estimates a 33.87% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-09-2024PublishedVulnerability first disclosed.
- 26-09-2024Last modifiedVulnerability information updated.
Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
33.87%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+0.24 pp
From 33.64% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundDragonfly2
Maturity: poc
Weaknesses
CWE · root causeAffected systems
D7y.io/dragonfly1 product
- v2≥ 2.1.0-alpha.0, < 2.1.0-beta.1 | < 2.0.9-rc.2 | < 2.1.0-beta.1
Dragonflyoss1 product
- dragonfly2< 2.0.9
Linuxfoundation1 product
- dragonfly< 2.0.9
3 vendors · 3 products
References
7 links- github.com/dragonflyoss/Dragonfly2/security/advisories/GHSA-hpc8-7wpm-889wX Refsource CONFIRMAdvisoryExploitVendor Advisory
