Dragonfly HTTP Protocol Vulnerability in Tiny File Download Scheduler Allows Man-in-the-Middle Attacks

A vulnerability exists in Dragonfly versions prior to 2.1.0, where the scheduler for downloading small files is hard coded to use the HTTP protocol instead of HTTPS. This flaw enables attackers to conduct Man-in-the-Middle attacks, intercepting and altering network requests to download different data. The issue is exacerbated by weak integrity checks, potentially allowing undetected modifications of the downloaded files.

Impact

Exploitation of this vulnerability could lead to unauthorized interception and alteration of data being downloaded, allowing malicious files to replace legitimate ones without detection.

Remediation

Users can upgrade to Dragonfly version 2.1.0 or later to address this vulnerability.