-
Notifications
You must be signed in to change notification settings - Fork 74
Description
Note: This issue documents a vulnerability that was originally reported privately as the repository security advisory GHSA-2q43-m63v-6j3r by @pbeza.
Root Cause
The AuthApi::Dev variant returns is_allowed: true for every authorization request, including KMS key replication. This is a runtime configuration option (auth_api.type = "dev" in config), not a compile-time feature gate. The get_meta endpoint exposes is_dev: true to unauthenticated callers, allowing attackers to discover misconfigured KMS instances.
// upgrade_authority.rs:63-70
AuthApi::Dev => Ok(AuthResponse {
is_allowed: true,
// ...
})Attack Path
- Attacker scans for KMS instances and calls
get_metaon each - Attacker finds a KMS instance with
is_dev: truein the response - Attacker requests key derivation for any app_id —
AuthApi::Devallows all - Attacker requests KMS key replication —
AuthApi::Devallows it - Attacker now has copies of all KMS root keys
Impact
A KMS instance running in dev mode has no authorization boundary. Any attacker with network access can derive keys for any app, replicate root keys to their own KMS instance, and completely compromise the key hierarchy. The get_meta endpoint makes discovery trivial.
Suggested Fix
Gate AuthApi::Dev behind a compile-time feature flag:
#[cfg(feature = "dev-mode")]
AuthApi::Dev => Ok(AuthResponse { is_allowed: true, ... }),
#[cfg(not(feature = "dev-mode"))]
AuthApi::Dev => Err(Error::DevModeDisabled),Remove is_dev from the get_meta response, or at minimum do not expose it to unauthenticated callers.
Note: This finding was reported automatically as part of an AI/Claude-driven internal audit by the NEAR One MPC team. It has not been manually verified by a human to confirm whether it constitutes an actual security issue.