BaseFortify

Executive Summary

Mooncake through version 0.3.13.post1 has a missing authentication vulnerability in its Store REST service. The service binds to 0.0.0.0 without requiring authentication on any route, allowing unauthenticated attackers to interact with it.

Useful 0 Not Useful 0

Detection Guidance

Check if the Mooncake Store REST service is running on 0.0.0.0 without authentication by scanning open ports. Use commands like 'netstat -tuln | grep 0.0.0.0' or 'ss -tuln | grep 0.0.0.0' to identify listening services. Verify if the service responds to requests to /api/get, /api/put, /api/remove_all, or /api/mount without authentication.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can exploit this to read cached key-value data containing user prompts, inject or delete objects, and mount attacker-described segments. This could lead to data theft, unauthorized modifications, or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by exposing sensitive user data (C:H in CVSS) and allowing unauthorized modifications (I:H, A:H in CVSS). It risks unauthorized access to personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict network access to the Mooncake Store REST service by binding it to localhost (127.0.0.1) instead of 0.0.0.0. Update Mooncake to the latest version that patches this vulnerability. If possible, disable the service entirely if not required.

Useful 0 Not Useful 0