Unauthenticated Disk Replica Eviction in Mooncake Store

Executive Summary

This vulnerability is a missing authorization flaw in Mooncake Store master through version 0.3.13.post1. It allows unauthenticated attackers to erase disk replicas of any object via EvictDiskReplica and BatchEvictDiskReplica RPCs. Attackers can reach the coro_rpc master port to delete DISK replicas across all tenants, potentially removing objects that only have a disk-based replica remaining.

Useful 0 Not Useful 0

Detection Guidance

Check if the Mooncake Store master service is running on the default coro_rpc port (50051) without authentication. Use network scanning tools like nmap to detect open ports and services. Example command: nmap -p 50051 <target-ip>. Inspect RPC calls to EvictDiskReplica and BatchEvictDiskReplica functions for unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could delete critical data by removing disk replicas, leading to permanent data loss if the disk replica is the last remaining copy. This could disrupt services relying on Mooncake Store for storage, especially in multi-tenant environments where data isolation is essential.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion or loss, violating data integrity and availability requirements in GDPR and HIPAA. Compliance may be impacted if sensitive or protected data is permanently lost due to the lack of proper authorization checks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the coro_rpc master port (50051) using firewalls or network policies. Disable or update the Mooncake Store master to a patched version if available. Monitor for unauthorized RPC calls to EvictDiskReplica and BatchEvictDiskReplica functions. Consider disabling disk replica eviction if not required.

Useful 0 Not Useful 0