Skip to content

Security: DevMode auth API unconditionally allows all apps and KMS replication #608

@kvinwang

Description

@kvinwang

Note: This issue documents a vulnerability that was originally reported privately as the repository security advisory GHSA-2q43-m63v-6j3r by @pbeza.

Root Cause

The AuthApi::Dev variant returns is_allowed: true for every authorization request, including KMS key replication. This is a runtime configuration option (auth_api.type = "dev" in config), not a compile-time feature gate. The get_meta endpoint exposes is_dev: true to unauthenticated callers, allowing attackers to discover misconfigured KMS instances.

// upgrade_authority.rs:63-70
AuthApi::Dev => Ok(AuthResponse {
    is_allowed: true,
    // ...
})

Attack Path

  1. Attacker scans for KMS instances and calls get_meta on each
  2. Attacker finds a KMS instance with is_dev: true in the response
  3. Attacker requests key derivation for any app_id — AuthApi::Dev allows all
  4. Attacker requests KMS key replication — AuthApi::Dev allows it
  5. Attacker now has copies of all KMS root keys

Impact

A KMS instance running in dev mode has no authorization boundary. Any attacker with network access can derive keys for any app, replicate root keys to their own KMS instance, and completely compromise the key hierarchy. The get_meta endpoint makes discovery trivial.

Suggested Fix

Gate AuthApi::Dev behind a compile-time feature flag:

#[cfg(feature = "dev-mode")]
AuthApi::Dev => Ok(AuthResponse { is_allowed: true, ... }),
#[cfg(not(feature = "dev-mode"))]
AuthApi::Dev => Err(Error::DevModeDisabled),

Remove is_dev from the get_meta response, or at minimum do not expose it to unauthenticated callers.


Note: This finding was reported automatically as part of an AI/Claude-driven internal audit by the NEAR One MPC team. It has not been manually verified by a human to confirm whether it constitutes an actual security issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions