Description
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kvcache-ai Mooncake
Default version status: unaffected
0 to ≤ 0.3.13.post1affected
pkg:pypi/mooncake-transfer-engineReferences
- https://github.com/kvcache-ai/Mooncake/issues/4478 ↗
- https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L5507-L5515 ↗
- https://github.com/kvcache-ai/Mooncake ↗
- https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-via-evictdiskreplica-rpc ↗