Unauthenticated Configuration Manipulation in NebulaGraph

NebulaGraph versions up to and including 3.8.0 are vulnerable to an authentication bypass in the embedded HTTP web service. The web server, defined in src/webservice/WebService.cpp, binds to all network interfaces by default and exposes administrative endpoints for reading and writing runtime flags (gflags). Crucially, this service lacks any form of authentication, token validation, or network access restriction.

An unauthenticated remote attacker can query the read route to extract sensitive information, including file paths for SSL/TLS certificates, private keys, password files, and data directories. Furthermore, the write route accepts arbitrary flag modifications via a map, which are applied immediately to the running daemon without requiring a restart. By interacting with this endpoint, an attacker can disable transport security features, redirect system logs, or alter authentication policy flags such as failed_login_attempts and password_lock_time_in_secs, effectively bypassing security controls and facilitating persistence or further system compromise.

Impact

Successful exploitation allows for full control over the daemon's runtime configuration. Attackers can facilitate data exfiltration or credential theft by disabling encryption, or weaken the system's security posture to enable unauthorized access. This poses a significant risk to the integrity and confidentiality of the database environment, particularly in deployments where the management interface is exposed to untrusted network segments.

Recommendation

• Immediately restrict access to the NebulaGraph web service port to trusted management IPs using host-based firewalls or network access control lists.
• Monitor all incoming HTTP traffic to the NebulaGraph daemon management port for unexpected POST requests containing JSON-formatted gflags.
• Audit the current configuration of all NebulaGraph nodes to verify that transport-security related flags have not been tampered with.
• Upgrade all instances of NebulaGraph to a patched version once released by the vendor.