Dgraph Unauthenticated External Snapshot Import Vulnerability in Alpha

A vulnerability exists in Dgraph Alpha versions through 25.3.4, where the RPCs for external snapshot import are exposed on the public gRPC port :9080 without any authentication or authorization. This allows an unauthenticated network client to initiate the 'StreamExtSnapshot' RPC and send Badger stream data to the target group's store. The vulnerability is particularly concerning because the 'Prepare()' method is called before the stream is processed, leading to the deletion of existing database data. This issue has been patched in version 25.3.5.

Impact

Exploitation of this vulnerability allows an unauthenticated attacker to clear a selected Dgraph group store or replace it with attacker-supplied Badger stream data. In deployments with Dgraph ACLs enabled, replacing group 1 could lead to privilege escalation.

Reproduction

To reproduce this vulnerability, first ensure that a Dgraph Alpha instance is running and accessible on the public gRPC port :9080, without mTLS enabled, and without any Dgraph ACL token, JWT, or gRPC 'auth-token' metadata. After starting the Dgraph instance, insert some synthetic data into the database. Then, from an unauthenticated client, open the 'StreamExtSnapshot' RPC, targeting group 1. The server will accept the unauthenticated stream, call 'Prepare()' to clear the existing database in the target group, and then finish the stream. This process can be automated with a Go program that uses the Dgraph client library to send the appropriate RPC requests.

Remediation

Users are advised to update to Dgraph version 25.3.5, where this vulnerability has been patched.