Authentication Bypass in Mooncake Store Leading to Data Deletion

Executive Summary

This vulnerability in Mooncake Store master through 0.3.13.post1 allows unauthenticated attackers to delete any object by exploiting missing authentication checks on the coro_rpc port. Attackers can send forged requests with the force flag enabled to bypass lease checks, wipe keys using regex patterns, or clear the entire store, leading to cache loss and service disruptions.

Useful 0 Not Useful 0

Detection Guidance

Check if the Mooncake Store master service is running on the coro_rpc port. Use netstat or ss to identify listening ports. Look for unauthenticated requests to endpoints like Remove, RemoveByRegex, RemoveAll, or BatchRemove with the force flag set.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause data loss by allowing attackers to delete critical cache entries or entire datasets. It may lead to service outages, unauthorized data removal, and potential denial-of-service conditions affecting applications relying on Mooncake Store for caching or storage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized data deletion or loss of integrity. Organizations may face penalties for failing to protect sensitive data, especially if the cache contained regulated information like personal or health records.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mooncake Store master to a version beyond 0.3.13.post1. Restrict network access to the coro_rpc port using firewalls. Implement authentication for RPC endpoints. Monitor logs for suspicious Remove operations.

Useful 0 Not Useful 0