Mixed Batch Authorization Bypass in Eclipse Milo

Executive Summary

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service incorrectly processes batch requests by dispatching all methods to handlers even after authorization checks. This allows low-privileged users to bypass restrictions by including a denied method in a batch with an allowed one.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Eclipse Milo version is between 1.0.0 and 1.1.4. Run commands like 'mvn dependency:tree' for Maven projects or inspect package manifests to verify the version. If vulnerable, update to a patched version immediately.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute unauthorized methods by batching them with permitted ones. This could lead to unauthorized actions, data manipulation, or system compromise depending on the affected methods.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit logging. Unauthorized method execution may lead to data breaches or unauthorized access, potentially violating GDPR, HIPAA, or other regulatory standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Eclipse Milo to a version beyond 1.1.4 where the authorization flaw is fixed. Apply the patch from the commit 'Restrict Call dispatch to authorized methods' to enforce stricter method dispatch checks.

Useful 0 Not Useful 0