Security: Unauthenticated /finish endpoint can shut down KMS onboard service

[kvinwang]

Note: This issue documents a vulnerability that was originally reported privately as the repository security advisory GHSA-fc72-qqqp-cjgr by @pbeza.

Root Cause

The KMS onboard service exposes a GET /finish endpoint that triggers shutdown.notify() with zero authentication. Any network-reachable caller can invoke this endpoint to shut down the onboard service, preventing new CVMs from bootstrapping their keys.

Attack Path

1. Attacker discovers the KMS onboard service endpoint
2. Attacker sends GET /finish — no authentication required
3. The onboard service shuts down via shutdown.notify()
4. New CVMs cannot bootstrap because the onboard service is unavailable
5. If the onboard service is critical to KMS initialization, this could prevent the entire KMS from becoming operational

Impact

Denial of service against the KMS bootstrapping process. New CVMs cannot obtain their initial keys and certificates. For MPC, this prevents new nodes from joining the threshold signing protocol. If the KMS is in the middle of initial setup, the /finish call prematurely terminates the bootstrap process.

Suggested Fix

Require authentication for the /finish endpoint:

#[get("/finish")]
async fn finish(admin_token: AdminToken, shutdown: &State<Notify>) -> &'static str {
    shutdown.notify_one();
    "OK"
}

Alternatively, restrict /finish to localhost-only access via network-level controls.

---

Note: This finding was reported automatically as part of an AI/Claude-driven internal audit by the NEAR One MPC team. It has not been manually verified by a human to confirm whether it constitutes an actual security issue.

[kvinwang]

Maintainer response (copied from private security advisory GHSA-fc72-qqqp-cjgr):

Thanks for the report.

The onboard service is a short-lived, temporary setup process used when configuring a new KMS node. It is not a persistent production service. The /finish endpoint simply signals that the operator has completed the initial configuration.

If an unauthorized party calls /finish prematurely, the operator can simply re-run the onboard process — there is no data loss or security compromise. Adding authentication to this ephemeral setup flow would introduce operational complexity without meaningful security benefit.

That said, for operators who are concerned about this during setup, the onboard service can be configured to listen on 127.0.0.1 only, or protected by firewall rules until configuration is complete before exposing the KMS to the public network.