Executive brief
Dragonfly is an open-source P2P-based file distribution system. A security flaw in its scheduler component allows an unauthenticated attacker to force the system to make requests to internal network addresses that should be private. This could allow an attacker to scan internal infrastructure or steal small amounts of sensitive data from internal services, such as cloud metadata or local administrative interfaces.
Technical details
The Dragonfly scheduler exposes a v1 gRPC service that, by default, lacks authentication and TLS. An attacker can invoke 'RegisterPeerTask' and 'ReportPeerResult' with a crafted 'PeerHost' message containing arbitrary IP addresses and ports (>= 1024). When the scheduler processes a 'TINY' task, it calls 'DownloadTinyFile', which uses a bare 'http.Transport' to fetch data from the attacker-supplied IP without validating if the destination is a global unicast address. This allows for read-SSRF against loopback (127.0.0.1), link-local (169.254.0.0/16), and RFC1918 addresses. The fetched content (up to 128 bytes) is stored in 'Task.DirectPiece' and can be exfiltrated by other peers. The vulnerability is fixed in version 2.4.4-rc.3 by implementing a safe dialer that rejects non-global-unicast destinations.
Affected products
- dragonflyoss dragonfly <= 2.4.4-rc.2
Timeline
- 2026-06-08: disclosed
- 2026-07-06: advisory