Dragonfly P2P File Distribution System Weak Integrity Check Vulnerability Allowing File Replacement

A vulnerability exists in Dragonfly, an open-source peer-to-peer file distribution and image acceleration system, in versions prior to 2.1.0. The issue arises because Dragonfly2 employs several hash functions, including MD5, for verifying downloaded files. MD5's lack of collision resistance allows attackers to substitute legitimate files with malicious ones that share the same hash. This vulnerability is addressed in version 2.1.0.

Impact

Exploitation of this vulnerability allows for the replacement of legitimate files with malicious ones, potentially leading to the execution of harmful code.

Reproduction

To reproduce this vulnerability, create two images: one innocuous and one containing malicious code. Ensure both images are divided into pieces that generate colliding MD5 hashes. Share the innocent image on the Dragonfly2 network, where it will be validated by peers. When another user downloads this image, the integrity check will pass, but the malicious image will be inadvertently used instead.

Remediation

Users can upgrade to Dragonfly version 2.1.0 or later to address this vulnerability.