TDengine Missing Authorization in KILL SSMIGRATE Allows Low-Privilege Users to Interrupt Shared-Storage Migrations

KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations Vulnerability Summary TDengine Enterprise 3.4.1.6 allows an authenticated low-privilege SQL user to run to interrupt an ongoing shared-storage migration, even though the user is denied permission to execute the corresponding operation. The 's handler parses the migration object and then invokes the path, while the expected privilege check has been commented out. Impact Scope Low-privilege authenticated users, if they can discover or view a shared-storage migration ID, can interrupt and remove migration tasks without requiring -level privileges. In shared-storage deployments, this can interfere with database data movement and migration availability. Affected versions: Main branch: 789116fc2da9fa8d8fd03367d82d62dd2bf075448 Latest public release tag: ver-3.4.1.6 at 003e8a5f102f76ee24da79e8f7bdbbea1442ca88 Runtime proof: tdengine/tdss:ee-3.4.1.6 - server version 3.4.1.6.enterprise, git 003e8a5f102f76ee24da79e8f7bdbbea1442ca88 Fix Enforce authorization boundaries identical to those for , which is currently modeled as . Specifically, restore the appropriate privilege check in before calling . If the migration ID maps to a database, prioritize a database-scope check equivalent to that used in the migration initiation path, rather than a broad system-wide check. Technical Details The parser exposes the command via in the SQL source: . The translator maps the statement to in , where registers to . In the current main branch and the latest release tag, retrieves the migration ID, but the authorization check is commented out prior to the path invocation. The missing privilege check is not an oversight in privilege definition. defines as a -class database privilege, and the function initiating shared-storage migrations, in , enforces . Reproduction The proof-of-concept uses with shared storage enabled, configured via . As root, create a shared-storage database, insert older rows, create a low-privilege user, and start the migration: The root session returns an active migration ID . As the low-privilege user, attempting to initiate a migration confirms that the same user is denied control: Result: The same low-privilege user can kill the active migration: Result: Server logs indicate that the low-privilege request reached the path and removed the migration:

Goal Reached Thanks to every supporter — we hit 100%!

TDengine Missing Authorization in KILL SSMIGRATE Allows Low-Privilege Users to Interrupt Shared-Storage Migrations

More from this source