GHSA-9wmw-9wph-2vwp: Dagu: SSE Authentication Bypass in Basic Auth Mode
SSE Authentication Bypass in Basic Auth ModeSummaryWhen Dagu is configured with HTTP Basic authentication (`DAGU_AUTH_MODE=basic`), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API.Severity**HIGH** (CVSS 3.1: 7.5 — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)Affected Versionsdagu v2.2.3 (latest) and likely all versions with basic auth supportAffected Component`internal/service/frontend/server.go` — `buildStreamAuthOptions()` function (lines 1177–1201)Root CauseThe `buildStreamAuthOptions()` function builds authentication options for SSE/streaming endpoints. When the auth mode is `basic`, it returns an `auth.Options` struct with `BasicAuthEnabled: true` but `AuthRequired` defaults to `false` (Go zero value):The authentication middleware at `internal/service/frontend/auth/middleware.go:181-183` allows unauthenticated requests when `AuthRequired` is false:The developers left a FIXME comment (line 1193) acknowledging this issue:Exposed SSE EndpointsAll SSE routes are affected (`server.go:1004-1019`):| Endpoint | Data Leaked |
|----------|-------------|
| `/api/v1/events/dags` | All DAG names, descriptions, file paths, schedules, tags, execution status |
| `/api/v1/events/dags/{fileName}` | Individual DAG configuration details |
| `/api/v1/events/dags/{fileName}/dag-runs` | DAG execution history |
| `/api/v1/events/dag-runs` | All active DAG runs across the system |
| `/api/v1/events/dag-runs/{name}/{dagRunId}` | Specific DAG run status and node details |
| `/api/v1/events/dag-runs/{name}/{dagRunId}/logs` | Execution logs (may contain secrets, credentials, API keys) |
| `/api/v1/events/dag-runs/{name}/{dagRunId}/logs/steps/{stepName}` | Step-level stdout/stderr logs |
| `/api/v1/events/queues` | Queue status and pending work items |
| `/api/v1/events/queues/{name}/items` | Queue item details |
| `/api/v1/events/docs-tree` | Documentation tree |
| `/api/v1/events/docs/*` | Documentation content |Additionally, the Agent SSE stream uses the same auth options (`server.go:1166`).Proof of ConceptSetupVerify REST API requires authExploit SSE bypass**Output (truncated):****Output:**Wrong credentials are rejectedImpactAn unauthenticated network attacker can:**Enumerate all workflows**: DAG names, descriptions, file paths, schedules, and tags**Monitor execution in real-time**: Track which workflows are running, their status, and when they complete**Read execution logs**: Access stdout/stderr of workflow steps, which commonly contain sensitive data (API keys, database credentials, tokens, internal hostnames)**Map infrastructure**: File paths and workflow configurations reveal server directory structure and deployment details**Observe queue state**: Understand pending work items and system loadThis is especially critical in environments where:Workflows process sensitive data (credentials, PII, financial data)DAG parameters contain secrets passed at runtimeLog output includes API responses or database queries with sensitive contentSuggested FixSet `AuthRequired: true` for basic auth mode and implement the session-token mechanism referenced in the FIXME comment:For browser SSE compatibility, implement a session token that can be passed via the `?token=` query parameter (the `QueryTokenMiddleware` already exists at `auth/middleware.go:39` to convert query params to Bearer tokens).
CVSS v3.1: 7.5