GitHub Security Advisory: GHSA-j8hf-cp34-g4j7
Package: d7y.io/dragonfly/v2 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2.4.1
Patched in: 2.4.1

Summary: Dragonfly Manager Job API Unauthenticated Access

Details:
## Summary

Dragonfly Manager's Job REST API endpoints lack authentication, allowing unauthenticated attackers to create, query, modify, and delete jobs, potentially leading to resource exhaustion, information disclosure, and service disruption.

## Affected Products

- **Product**: Dragonfly
- **Component**: Manager (REST API)
- **Affected Versions**: v2.x (based on source code analysis, including v2.4.0)
- **Affected Endpoints**: `/api/v1/jobs`

## Vulnerability Details

### Description

Dragonfly Manager's Job API endpoints (`/api/v1/jobs`) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to perform the following operations:

1. **List all jobs** (GET `/api/v1/jobs`)
2. **Create new jobs** (POST `/api/v1/jobs`)
3. **Query job details** (GET `/api/v1/jobs/:id`)
4. **Modify jobs** (PATCH `/api/v1/jobs/:id`)
5. **Delete jobs** (DELETE `/api/v1/jobs/:id`)

### Technical Root Cause

In the source code file `manager/router/router.go` at lines 204-211, the Job API route group lacks authentication middleware:

```go
// TODO Add auth to the following routes and fix the tests.
// Job.
job := apiv1.Group("/jobs")
job.POST("", middlewares.CreateJobRateLimiter(limiter), h.CreateJob)
job.DELETE(":id", h.DestroyJob)
job.PATCH(":id", h.UpdateJob)
job.GET(":id", h.GetJob)
job.GET("", h.GetJobs)
```

In contrast, other API endpoints (such as `/clusters`) are correctly configured with authentication:

```go
// manager/router/router.go:143
c := apiv1.Group("/clusters", jwt.MiddlewareFunc(), rbac)
```

The developer left a TODO comment in the code, indicating this is a known but unresolved issue.

## Proof of Concept

### Environment Setup

#### Prerequisites
- Kubernetes cluster (Kind/Minikube/GKE, etc.)
- Helm 3.8.0+
- kubectl
- curl and jq

#### Deployment Steps

1. **Add Dragonfly Helm Repository**
```bash
helm repo add dragonfly https://dragonflyoss.github.io/helm-charts/
helm repo update
```

2. **Generate Deployment Manifest**
```bash
helm template dragonfly dragonfly/dragonfly \
  --namespace dragonfly-system \
  --set manager.replicas=1 \
  --set scheduler.replicas=1 \
  --set seedClient.replicas=1 \
  --set client.enable=false > /tmp/dragonfly-manifest.yaml
```

3. **Deploy to Kubernetes**
```bash
kubectl create namespace dragonfly-system
kubectl apply -f /tmp/dragonfly-manifest.yaml -n dragonfly-system
kubectl -n dragonfly-system wait --for=condition=Ready pods --all --timeout=600s
```

**Expected Output**:
```
namespace/dragonfly-system created
[... resource creation messages ...]
pod/dragonfly-manager-5cc788d64b-grpbk condition met
pod/dragonfly-mysql-0 condition met
pod/dragonfly-redis-master-0 condition met
pod/dragonfly-scheduler-0 condition met
pod/dragonfly-seed-client-0 condition met
```

4. **Setup Port Forwarding**
```bash
kubectl -n dragonfly-system port-forward svc/dragonfly-manager 8080:8080 &
```

### Exploitation Steps

#### S