Authentication Bypass in Mooncake Metadata Server

Mooncake through version 0.3.13.post1 contains a critical missing authentication vulnerability in its HTTP metadata server, specifically within the /metadata handler. This vulnerability allows an unauthenticated, remote attacker to perform unauthorized read, overwrite, and delete operations on sensitive transfer engine metadata keys.

The flaw is significant because it allows attackers to poison segment descriptors, such as the 'tcp_data_port' key, or re-create 'rpc_meta' entries. By manipulating these metadata keys, an attacker can effectively redirect KV cache transfers to attacker-controlled listeners, leading to potential data interception. Furthermore, the ability to overwrite or delete metadata keys can be leveraged to exhaust server memory, resulting in a denial-of-service condition. Given the nature of the application, this flaw poses a high risk to data integrity and availability for deployments utilizing the Mooncake transfer engine.

Impact

Successful exploitation allows unauthenticated attackers to intercept data transfers by redirecting KV cache traffic or crash the service by exhausting system memory. The vulnerability affects all Mooncake deployments using versions up to 0.3.13.post1.

Recommendation

1. Upgrade to the latest version of Mooncake (beyond 0.3.13.post1) immediately upon the vendor release of a security patch.
2. Implement network-level access controls to restrict access to the Mooncake HTTP metadata server port to trusted administrative subnets only.
3. Monitor webserver logs for unauthorized HTTP requests to the /metadata endpoint, specifically those utilizing PUT, POST, or DELETE methods from unexpected IP addresses.