Use of Hard-coded Cryptographic Key Affecting github.com/dragonflyoss/dragonfly2/manager/router package, versions <2.1.0-beta.1
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
5.38% (94th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMDRAGONFLYOSSDRAGONFLY2MANAGERROUTER-8062320
- published 20 Sep 2024
- disclosed 19 Sep 2024
- credit cokeBeer
Introduced: 19 Sep 2024
CVE-2023-27584 Open this link in a new tabHow to fix?
Upgrade github.com/dragonflyoss/Dragonfly2/manager/router to version 2.1.0-beta.1 or higher.
Overview
Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the JWT authentication middleware. An attacker can impersonate any user, including administrative accounts, by generating a valid JWT with the known secret key.