Milvus RBAC Privilege Escalation via Truncated MD5 Grantee-ID Collision

Vulnerability Overview Vulnerability Name: RBAC grantee-id uses truncated MD5 (64-bit), leading to permission binding collisions and cross-role permission forgery. Vulnerability ID: #49857 Status: Accepted (triage accepted) Affected Scope Milvus Version: milvusdb/milvus:v2.6.13 Deployment Mode: Standalone MQ: rocksmq SDK: pymilvus 2.0.0 Operating System: Debian/Linux Remediation Root Cause: Milvus uses a truncated MD5 (64-bit) as the RBAC grantee-id, which allows different authorization relationships to share the same grantee-id, resulting in permission binding collisions. Remediation Recommendations: - Use the full 128-bit MD5 output as the authorization binding identifier. - Follow OWASP session management guidelines to ensure session identifiers possess at least 64 bits of entropy; it is recommended to use a CSPRNG to generate identifiers with at least 128 bits. - Avoid using predictable or controllable authorization state identifiers to prevent attackers from resolving permissions of other roles through collision attacks. POC Code Trigger Conditions Frequency: Occurs whenever the victim's parent key shares a grantee-id with the donor. Observation: Observed immediately after a standalone restart, following the reloading of forged RBAC metadata. Non-trigger: When the victim's key retains its own grantee-id value. Expected Behavior RBAC grant identifiers should possess sufficient collision resistance to ensure that two distinct authorization relationships never share the same grantee-id namespace. Even if an attacker can influence role/object/object-name values, one role should not be able to resolve the permissions of another role. The authorization binding identifier must meet at least a 128-bit security level in this context. Actual Behavior Milvus derives the RBAC grantee-id from a truncated MD5, retaining only 16 characters (i.e., 64 bits). This value is written as the parent key mapping value in and then used to locate the permission subtree. When two distinct parent keys share the same 64-bit grantee-id, the victim role resolves to the donor's permission subtree. In local Docker validation, this caused the victim to transition from "permission denied" to successfully inserting into the donor's collection after a standalone restart. Error Logs Permission Denied: Permission Granted: Non-default Configuration Analysis Notes (Optional) Suspect Code Locations: - - - Root Cause: - The full MD5 output is 128 bits. - The implementation truncates it to 64 bits before using it as an authorization binding identifier. - This reduces the work factor for an arbitrary collision from a 128-bit space to a 64-bit space, making birthday collisions practically searchable. OWASP Guidance: - The OWASP Session Management Cheat Sheet states that session identifiers must have at least 64 bits of entropy and explicitly recommends using a CSPRNG to generate identifiers with at least 128 bits if the application creates its own session IDs. - The same OWASP guidance explains that session IDs or tokens bind authentication status and access control status to application traffic; this is the closest standard analogy to binding roles/permissions to the authorization namespace via in this project. - OWASP Session Prediction identifies "manipulating user privilege identifiers" as an attack result when identifiers protecting authorization status are predictable or controllable. Security Issue: - This is not merely an issue of "MD5 being outdated," but rather that the RBAC authorization binding identifier falls below the 128-bit minimum threshold. - Once a collision is achieved, the donor and victim share the same namespace, allowing the victim to resolve the donor's permissions. Local Verification Artifacts: - - - OWASP References: - OWASP Session Management Cheat Sheet - OWASP Session Prediction

Goal Reached Thanks to every supporter — we hit 100%!

Milvus RBAC Privilege Escalation via Truncated MD5 Grantee-ID Collision

More from this source