Dragonfly P2P File Distribution System TLS Certificate Verification Vulnerability in Manager Component

A vulnerability exists in Dragonfly, an open-source P2P-based file distribution and image acceleration system, in versions prior to 2.1.0. The issue arises because the Manager component disables TLS certificate verification in its HTTP clients, which are not user-configurable. This lack of verification leaves the Manager susceptible to network-level Man-in-the-Middle attacks, where an adversary can inject invalid data. As a result, the Manager may process incorrect information during preheat jobs, leading to denial-of-service conditions and file integrity issues.

Impact

Exploitation of this vulnerability allows for network-level Man-in-the-Middle attacks, where an attacker can intercept and manipulate data sent to the Manager. This interference causes the Manager to preheat with incorrect data, resulting in denial-of-service conditions and file integrity problems.

Remediation

Users can upgrade to Dragonfly version 2.1.0 or later to address this vulnerability. There are no effective workarounds available.