Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dagu SSE Authentication Bypass in Basic Auth Mode
Vulnerability Description
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
关键功能的认证机制缺失
Vulnerability Title
dagu 访问控制错误漏洞
Vulnerability Description
dagu是Dagu Workflow Engine开源的一个工作流引擎。 dagu 2.2.4之前版本存在访问控制错误漏洞，该漏洞源于配置HTTP基本身份验证时，所有服务器发送事件端点无需凭据即可访问，可能导致未经验证的攻击者绕过身份验证访问实时数据。
CVSS Information
N/A
Vulnerability Type
N/A