Dragonfly P2P File Distribution Directory Permission Vulnerability

A directory permission vulnerability exists in Dragonfly versions prior to 2.1.0. The issue arises because the application uses the os.MkdirAll function to create directory paths with specific permissions. This function does not check permissions on existing directories, allowing a local attacker to preemptively create directories with broad permissions. Consequently, the attacker could manipulate files within these directories before Dragonfly does, potentially interfering with the application's operations.

Impact

Exploitation allows a local attacker to create directories with 0777 permissions, enabling them to delete and modify files within those directories. This manipulation can alter the outcomes of commands executed by the user.

Remediation

Users are advised to upgrade to Dragonfly version 2.1.0 or later.