Security: Unauthenticated bootstrap endpoint can overwrite root keys #610

Note: This issue documents a vulnerability that was originally reported privately as the repository security advisory GHSA-f7w3-x786-xvh7 by @pbeza.

Root Cause

The KMS bootstrap endpoint has no authentication and no idempotency check. It accepts root key material (or generates it) and persists it. If called multiple times, subsequent calls can overwrite previously set root keys. During the initial KMS setup window, a race condition allows an attacker to substitute their own root keys.

Attack Path

1. Legitimate operator initiates KMS bootstrap
2. Attacker concurrently calls the bootstrap endpoint with their own root key material
3. If the attacker's request arrives first (or the endpoint allows overwrites), attacker's keys are persisted
4. All subsequent key derivations use the attacker's root keys
5. Attacker controls the entire key hierarchy for all CVMs using this KMS

Impact

If an attacker wins the bootstrap race, they control the root keys for the entire KMS instance. All app keys, disk encryption keys, and signing keys derived from this KMS are compromised. For MPC, all keyshares and signing keys are under attacker control.

Suggested Fix

1. Add authentication to the bootstrap endpoint (e.g., require a pre-shared bootstrap token)
2. Add idempotency: reject bootstrap if root keys are already set
3. Use a file-based lock to ensure atomicity:

if root_keys_exist() {
    return Err(Error::AlreadyBootstrapped);
}

4. Log all bootstrap attempts for audit purposes

Note: This finding was reported automatically as part of an AI/Claude-driven internal audit by the NEAR One MPC team. It has not been manually verified by a human to confirm whether it constitutes an actual security issue.