LMCache Missing Authentication in Multiprocess Mode

Executive Summary

LMCache through version 0.5.5 has a missing authentication vulnerability in its multiprocess mode HTTP server. This flaw allows remote attackers to access management endpoints without authentication. Attackers can read environment credentials via GET /env, view configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data.

Useful 0 Not Useful 0

Detection Guidance

• Check if LMCache is running on port 8080 by default. Use commands like 'netstat -tulnp | grep 8080' or 'ss -tulnp | grep 8080' to verify if the HTTP server is listening on all interfaces (0.0.0.0:8080).
• Send HTTP GET requests to endpoints like /env, /config, /status, /quota, /cache/clear, and /cache/objects to check for unauthenticated access. Example: 'curl http://<target-ip>:8080/env' or 'curl http://<target-ip>:8080/config'.
• Inspect network traffic for unusual activity targeting port 8080 or other HTTP endpoints associated with LMCache management APIs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive data like API tokens and service credentials, delete or modify cached data, and disrupt services by clearing caches or evicting other tenants' data. It can lead to data breaches, service disruptions, and unauthorized access to system configurations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA by exposing sensitive data such as environment credentials and configuration details. Unauthorized access to cached data may violate data protection requirements, leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict network access to the LMCache HTTP server by binding it to localhost (127.0.0.1) instead of all interfaces (0.0.0.0). Update firewall rules to block external access to port 8080 or the LMCache management endpoints.

Disable or remove the LMCache multiprocess HTTP server if it is not required for operations. Monitor for any unauthorized cache modifications or data exfiltration attempts.

Apply network segmentation to isolate the LMCache server from untrusted networks. Review and remove sensitive data from environment variables and configurations exposed by the /env and /config endpoints.

Useful 0 Not Useful 0