Dragonfly Manager Job API Allows Unauthenticated Access

Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly2 vulnerable to hard coded cyptographic key

Dragonfly did not enable authentication for some Manager’s endpoints

Manager generates mTLS certificates for arbitrary IP addresses

Dragonfly incorrectly handles a task structure’s usedTraffic field

Dragonfly Manager makes requests to external endpoints with disabled TLS authentication

Dragonfly has weak integrity checks for downloaded files

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Timing attacks against Proxy’s basic authentication are possible

Dragonfly server-side request forgery vulnerability

Dragonfly tiny file download uses hard coded HTTP protocol

Directories created via os.MkdirAll are not checked for permissions