CVE-2025-59345: Dragonfly Manager DOS Vulnerability

CVE-2025-59345 Overview

CVE-2025-59345 is a missing authentication vulnerability in Dragonfly, an open source P2P-based file distribution and image acceleration system maintained by the Linux Foundation. Prior to version 2.1.0, the /api/v1/jobs and /preheats endpoints in the Manager web UI are accessible without authentication, allowing any user with network access to create, delete, and modify jobs, as well as create preheat jobs without authorization.

Critical Impact

Unauthenticated attackers with network access to the Manager web UI can create hundreds of malicious jobs, causing denial-of-service conditions that prevent legitimate administrators from managing the system.

Affected Products

• Linuxfoundation Dragonfly versions prior to 2.1.0
• Dragonfly Manager web UI component
• Systems running Dragonfly with exposed Manager endpoints

Discovery Timeline

• 2025-09-17 - CVE-2025-59345 published to NVD
• 2025-10-13 - Last updated in NVD database

Technical Details for CVE-2025-59345

Vulnerability Analysis

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The Dragonfly Manager web UI exposes administrative API endpoints without requiring authentication, creating a significant security gap in environments where the Manager interface is network-accessible.

The vulnerability allows unauthenticated adversaries to interact with critical job management functionality. By sending requests to the /api/v1/jobs endpoint, attackers can flood the system with useless jobs, exhausting system resources and effectively rendering the Manager unusable. This represents a serious integrity impact as unauthorized parties can manipulate the job queue and system state.

The attack is network-based and requires no user interaction or prior authentication, making it trivially exploitable once an attacker has network connectivity to the Manager web UI.

Root Cause

The root cause of this vulnerability is the absence of authentication enforcement on the /api/v1/jobs and /preheats API endpoints in the Manager web UI. These endpoints were designed to handle administrative functions but lacked proper access control mechanisms to verify the identity and authorization of incoming requests before processing them.

Attack Vector

An attacker with network access to the Dragonfly Manager web UI can exploit this vulnerability by sending unauthenticated HTTP requests directly to the vulnerable endpoints. The attack requires no special tools or credentials—only network connectivity to the Manager service.

The exploitation scenario involves an attacker repeatedly calling the /api/v1/jobs endpoint to create numerous useless jobs. As the job queue fills with malicious entries, the Manager becomes overwhelmed and enters a denial-of-service state, rejecting legitimate administrative requests. This can disrupt file distribution operations across the entire P2P network managed by the affected Dragonfly instance.

For technical details on the vulnerability mechanism, see the GitHub Security Advisory GHSA-89vc-vf32-ch59.

Detection Methods for CVE-2025-59345

Indicators of Compromise

• Unusual spike in job creation requests to /api/v1/jobs endpoint from external or unexpected IP addresses
• Large number of jobs created in a short time period without corresponding legitimate administrative activity
• Manager service becoming unresponsive or returning errors to authenticated administrators
• Network logs showing unauthenticated requests to /api/v1/jobs or /preheats endpoints

Detection Strategies

• Monitor HTTP access logs for the Manager web UI for requests to /api/v1/jobs and /preheats endpoints from unauthorized sources
• Implement rate limiting detection to identify abnormal patterns of API calls that may indicate exploitation attempts
• Deploy network intrusion detection rules to alert on bulk job creation requests to Dragonfly Manager endpoints
• Review job creation audit logs for entries created without associated authenticated user sessions

Monitoring Recommendations

• Configure alerts for Manager service availability degradation or increased response times
• Implement application-level logging to track all job creation, modification, and deletion activities
• Monitor system resource utilization on Manager hosts for signs of resource exhaustion attacks
• Establish baseline metrics for normal job creation rates to facilitate anomaly detection

How to Mitigate CVE-2025-59345

Immediate Actions Required

• Upgrade Dragonfly to version 2.1.0 or later immediately
• Restrict network access to the Manager web UI using firewall rules or network segmentation
• Audit existing jobs for unauthorized or suspicious entries and remove them
• Review access logs for evidence of prior exploitation attempts

Patch Information

This vulnerability is fixed in Dragonfly version 2.1.0. Organizations should upgrade to this version or later to remediate the authentication bypass. For detailed patch information, refer to the GitHub Security Advisory GHSA-89vc-vf32-ch59 and the Dragonfly Security Report 2023.

Workarounds

• Implement network-level access controls to restrict Manager web UI access to trusted IP addresses only
• Deploy a reverse proxy with authentication in front of the Manager web UI to enforce access control
• Use VPN or private network configurations to prevent untrusted network access to Manager endpoints
• Consider temporarily disabling the Manager web UI if immediate patching is not possible

# Example: Restrict Manager access using iptables (adjust IP ranges as needed)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP