Summary
Mooncake Store master contains a missing authorization vulnerability in the EvictDiskReplica and BatchEvictDiskReplica operations. An unauthenticated attacker who can reach the master coroutine RPC port may remove disk replicas across tenants, potentially deleting objects whose only remaining replica is stored on disk.
Mooncake Store master contains a missing authorization vulnerability in the EvictDiskReplica and BatchEvictDiskReplica operations. An unauthenticated attacker who can reach the master coroutine RPC port may remove disk replicas across tenants, potentially deleting objects whose only remaining replica is stored on disk.
Affected context
The issue occurs in Mooncake Store master deployments where the coroutine RPC service exposes disk-replica eviction operations without sufficiently verifying the caller's authorization. Risk is higher when the master RPC port is reachable by untrusted or insufficiently trusted networks and when objects depend on disk replicas for durability.
The issue occurs in Mooncake Store master deployments where the coroutine RPC service exposes disk-replica eviction operations without sufficiently verifying the caller's authorization. Risk is higher when the master RPC port is reachable by untrusted or insufficiently trusted networks and when objects depend on disk replicas for durability.
Exploit preconditions
- Attack surface: Mooncake Store master coroutine RPC service
- Required access: Network reachability to the master RPC port; authentication may not be required
- Trigger point: The EvictDiskReplica or BatchEvictDiskReplica request handlers
- Authorization condition: The service does not adequately verify whether the caller may evict the targeted replicas or affect other tenants
- Why exploitation is possible: Destructive replica-management operations can be invoked without effective access-control enforcement
- Attack surface: Mooncake Store master coroutine RPC service
- Required access: Network reachability to the master RPC port; authentication may not be required
- Trigger point: The EvictDiskReplica or BatchEvictDiskReplica request handlers
- Authorization condition: The service does not adequately verify whether the caller may evict the targeted replicas or affect other tenants
- Why exploitation is possible: Destructive replica-management operations can be invoked without effective access-control enforcement
Why this happens
The underlying bug is an authorization failure in which sensitive state-changing operations are exposed without a reliable permission check tied to the requesting identity and target tenant. This maps to CWE-862: Missing Authorization, because the application performs destructive replica eviction without adequately determining whether the caller is permitted to perform that action.
The underlying bug is an authorization failure in which sensitive state-changing operations are exposed without a reliable permission check tied to the requesting identity and target tenant. This maps to CWE-862: Missing Authorization, because the application performs destructive replica eviction without adequately determining whether the caller is permitted to perform that action.
Potential impact
- Attackers may delete disk replicas belonging to other tenants
- Objects may become unavailable when their only remaining replica is removed
- Data durability and service availability could be reduced
- Batch eviction requests could amplify the scope of disruption
- Cross-tenant isolation may be weakened
- Attackers may delete disk replicas belonging to other tenants
- Objects may become unavailable when their only remaining replica is removed
- Data durability and service availability could be reduced
- Batch eviction requests could amplify the scope of disruption
- Cross-tenant isolation may be weakened
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the RPC service boundary for every destructive operation.
Common defensive patterns include:
- Require authenticated, tenant-aware identities before processing replica-eviction requests
- Apply explicit authorization checks to both single-object and batch operations
- Enforce tenant and object ownership boundaries server-side rather than trusting client-supplied scope
- Keep the master RPC port on restricted network segments and deny unnecessary exposure
- Use least-privilege service identities and separate administrative capabilities from routine data-plane access
- Add safeguards such as policy checks, confirmation requirements, and protection for the final available replica
Mitigation generally focuses on enforcing authorization at the RPC service boundary for every destructive operation.
Common defensive patterns include:
- Require authenticated, tenant-aware identities before processing replica-eviction requests
- Apply explicit authorization checks to both single-object and batch operations
- Enforce tenant and object ownership boundaries server-side rather than trusting client-supplied scope
- Keep the master RPC port on restricted network segments and deny unnecessary exposure
- Use least-privilege service identities and separate administrative capabilities from routine data-plane access
- Add safeguards such as policy checks, confirmation requirements, and protection for the final available replica
How teams detect issues like this
Organizations can detect missing-authorization risks through:
- Static analysis and security tests that identify state-changing RPC handlers lacking centralized permission checks
- Code review signals such as direct mutation or deletion operations based only on client-provided object or tenant identifiers
- Integration tests covering unauthenticated, cross-tenant, and unauthorized batch requests
- RPC access logs that record caller identity, tenant, target objects, and eviction outcomes
- Network policy enforcement that limits access to master control-plane ports
- Automated security review tools that flag destructive endpoints without authentication and authorization gates
Organizations can detect missing-authorization risks through:
- Static analysis and security tests that identify state-changing RPC handlers lacking centralized permission checks
- Code review signals such as direct mutation or deletion operations based only on client-provided object or tenant identifiers
- Integration tests covering unauthenticated, cross-tenant, and unauthorized batch requests
- RPC access logs that record caller identity, tenant, target objects, and eviction outcomes
- Network policy enforcement that limits access to master control-plane ports
- Automated security review tools that flag destructive endpoints without authentication and authorization gates
