Summary
Mooncake Store exposes object-removal operations on its coro_rpc interface without requiring authentication. An unauthenticated attacker may delete individual objects, remove keys matching arbitrary patterns, or clear the store, potentially causing cache loss and request failures.
Mooncake Store exposes object-removal operations on its coro_rpc interface without requiring authentication. An unauthenticated attacker may delete individual objects, remove keys matching arbitrary patterns, or clear the store, potentially causing cache loss and request failures.
Affected context
The issue may occur in Mooncake Store master through 0.3.13.post1 when the coro_rpc endpoint is network-reachable and its removal operations do not enforce caller authentication or authorization. Deployments that expose this interface beyond a trusted internal boundary may be especially at risk.
The issue may occur in Mooncake Store master through 0.3.13.post1 when the coro_rpc endpoint is network-reachable and its removal operations do not enforce caller authentication or authorization. Deployments that expose this interface beyond a trusted internal boundary may be especially at risk.
Exploit preconditions
- Attack surface: The Mooncake Store
coro_rpcinterface - Required access: Network reachability to the interface; no valid credentials are required
- Trigger point: Invocation of object-removal operations such as
Remove,RemoveByRegex,RemoveAll, orBatchRemove - Why exploitation is possible: The service accepts removal requests without verifying the caller's identity or authorization, and request flags may bypass lease-related checks
- Attack surface: The Mooncake Store
coro_rpcinterface - Required access: Network reachability to the interface; no valid credentials are required
- Trigger point: Invocation of object-removal operations such as
Remove,RemoveByRegex,RemoveAll, orBatchRemove - Why exploitation is possible: The service accepts removal requests without verifying the caller's identity or authorization, and request flags may bypass lease-related checks
Why this happens
The underlying bug is an authorization boundary failure: security-sensitive removal procedures are exposed without an authentication check that reliably identifies and authorizes the caller. This maps to CWE-306, Missing Authentication for Critical Function, because destructive operations can be reached by unauthenticated clients. Trusting request-supplied deletion controls, including force-related behavior, can further weaken safeguards intended to protect leased or active objects.
The underlying bug is an authorization boundary failure: security-sensitive removal procedures are exposed without an authentication check that reliably identifies and authorizes the caller. This maps to CWE-306, Missing Authentication for Critical Function, because destructive operations can be reached by unauthenticated clients. Trusting request-supplied deletion controls, including force-related behavior, can further weaken safeguards intended to protect leased or active objects.
Potential impact
- An attacker may delete selected objects from the store
- An attacker could remove keys matching broad patterns
- An attacker may clear the entire store
- Applications can experience cache loss, request failures, or service disruption
- Dependent workflows could encounter stale, missing, or unavailable data
- An attacker may delete selected objects from the store
- An attacker could remove keys matching broad patterns
- An attacker may clear the entire store
- Applications can experience cache loss, request failures, or service disruption
- Dependent workflows could encounter stale, missing, or unavailable data
General mitigation guidance
Mitigation generally focuses on protecting every destructive RPC with
authentication and authorization rather than relying on network location or
lease checks alone.
Common defensive patterns include:
- Requiring strong service-to-service authentication for the coro_rpc interface
- Applying operation-level authorization and least-privilege identities
- Treating force or override flags as privileged actions requiring explicit authorization
- Restricting interface exposure through network policy, segmentation, and trusted service boundaries
- Validating deletion scope and using guarded defaults for bulk-removal operations
- Recording and alerting on destructive requests, including bulk and pattern-based removals
Mitigation generally focuses on protecting every destructive RPC with
authentication and authorization rather than relying on network location or
lease checks alone.
Common defensive patterns include:
- Requiring strong service-to-service authentication for the coro_rpc interface
- Applying operation-level authorization and least-privilege identities
- Treating force or override flags as privileged actions requiring explicit authorization
- Restricting interface exposure through network policy, segmentation, and trusted service boundaries
- Validating deletion scope and using guarded defaults for bulk-removal operations
- Recording and alerting on destructive requests, including bulk and pattern-based removals
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis and API audits that identify RPC handlers lacking authentication or authorization checks
- Code review signals such as destructive methods registered on unauthenticated listeners
- Tests that exercise critical functions with anonymous callers and verify denial by default
- Policy enforcement requiring authenticated identities and least-privilege authorization for administrative interfaces
- Runtime monitoring for unexpected
Remove,RemoveByRegex,RemoveAll, orBatchRemoveactivity and unusual use of override flags
Automated security review tools may help identify missing middleware or inconsistent access-control enforcement.
Organizations can look for this weakness through:
- Static analysis and API audits that identify RPC handlers lacking authentication or authorization checks
- Code review signals such as destructive methods registered on unauthenticated listeners
- Tests that exercise critical functions with anonymous callers and verify denial by default
- Policy enforcement requiring authenticated identities and least-privilege authorization for administrative interfaces
- Runtime monitoring for unexpected
Remove,RemoveByRegex,RemoveAll, orBatchRemoveactivity and unusual use of override flags
Automated security review tools may help identify missing middleware or inconsistent access-control enforcement.
