Dragonfly Remote Code Execution Vulnerability via Arbitrary File Read and Write

A vulnerability in Dragonfly, an open-source P2P file distribution and image acceleration system, allows for remote code execution by exploiting the gRPC and HTTP APIs. Prior to version 2.1.0, these APIs permitted peers to send requests that could force the recipient to create files in arbitrary locations or read existing files. This capability could be misused to access sensitive data from other peers and execute code remotely on their machines.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data and remote code execution on the affected peer's machine.

Remediation

Users are advised to upgrade to Dragonfly version 2.1.0 or later.