Attack Chain

1. Attacker identifies a Central Dogma cluster with high-availability replication enabled but without a customized replication.secret.
2. Attacker establishes network connectivity to a ZooKeeper quorum port (exposed on the inter-replica network) or utilizes local access to reach the loopback-bound client port.
3. Attacker initiates a SASL DIGEST-MD5 handshake using the username 'super' and the publicly known default secret 'ch4n63m3'.
4. Authentication succeeds, allowing the attacker to join the ZK ensemble as a learner or authenticate as a super-user client.
5. Attacker enumerates existing configuration logs via the ZK znodes /dogma/logs and /dogma/log_blocks.
6. Attacker monitors replication in real-time to intercept sensitive configuration secrets or session master keys.
7. Attacker optionally injects forged ReplicationLog entries to be replayed by legitimate replicas, leading to unauthorized command execution such as PURGE_PROJECT or ROTATE_SESSION_MASTER_KEY across all cluster nodes.

Impact

Successful exploitation results in a complete cluster takeover. An attacker can read the entire history of configuration changes, including pushed file contents and sensitive encryption keys. By injecting forged logs, an attacker can execute arbitrary commands across all replicas, permanently delete projects, or re-encrypt data with attacker-controlled keys. The blast radius covers all services and microservices that consume data from the compromised Central Dogma instance.

Recommendation

Prioritize immediate audit of Central Dogma configurations across all production and staging environments to ensure a unique, complex replication.secret is explicitly defined. Implement network segmentation and firewall rules to strictly limit access to the ZooKeeper quorum ports (defaulting to the ports configured in replication.servers) to known peer IP addresses only. Upgrade to a patched version that removes the silent fallback mechanism and enforces explicit secret definition.