BIT-mlflow-2024-3848
Path Traversal vulnerability in mlflow (PyPI)
What is BIT-mlflow-2024-3848 About?
This is a path traversal vulnerability in mlflow/mlflow version 2.11.0, acting as a bypass for a previous CVE. It allows an attacker to read arbitrary files by crafting artifact URLs that exploit inadequate validation of URL fragments. The vulnerability is relatively easy to exploit, potentially leading to the disclosure of sensitive information like SSH and cloud keys.
Affected Software
- mlflow
- <2.12.1
- <f8d51e21523238280ebcfdb378612afd7844eca8
- >2.9.2, <2.12.1
Technical Details
The vulnerability in mlflow/mlflow version 2.11.0, a bypass for CVE-2023-6909, stems from the application's handling of artifact URLs. An attacker can insert a '#' character into an artifact URL to introduce a path into the URL fragment. Due to insufficient validation, the application's processing of this URL ignores the protocol scheme and incorrectly interprets the fragment as a filesystem path. This allows the attacker to construct a URL that, when resolved, leads to arbitrary file read operations, granting access to any file accessible by the mlflow process, including sensitive credentials.
What is the Impact of BIT-mlflow-2024-3848?
Successful exploitation may allow attackers to read arbitrary files from the server's file system, potentially leading to the disclosure of sensitive information such as SSH keys, cloud access keys, or other confidential data.
What is the Exploitability of BIT-mlflow-2024-3848?
Exploitation requires the ability to interact with the mlflow application's artifact URL handling. While no specific authentication or high privilege level is explicitly mentioned, the nature of artifact URLs suggests an authenticated context may be implied for legitimate usage, though the vulnerability itself could be triggered by any entity capable of submitting crafted URLs. The attack is remote. The complexity lies in understanding how to craft the URL with the '#' character to bypass validation and correctly manipulate the fragment to achieve path traversal. The risk of exploitation is high if attackers can submit or influence artifact URLs processed by the system, as successful exploitation exposes highly sensitive data.
What are the Known Public Exploits?
| PoC Author | Link | Commentary |
|---|---|---|
| No known exploits | ||
What are the Available Fixes for BIT-mlflow-2024-3848?
Available Upgrade Options
- mlflow
- <f8d51e21523238280ebcfdb378612afd7844eca8 → Upgrade to f8d51e21523238280ebcfdb378612afd7844eca8
- mlflow
- >2.9.2, <2.12.1 → Upgrade to 2.12.1
Struggling with dependency upgrades?
See how Resolved Security's drop-in replacements make it simple.
Book a demoAdditional Resources
- https://osv.dev/vulnerability/PYSEC-2024-244
- https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8
- https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-244.yaml
- https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8
- https://github.com/mlflow/mlflow
- https://nvd.nist.gov/vuln/detail/CVE-2024-3848
- https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610
- https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8
- https://osv.dev/vulnerability/GHSA-rfqq-wq6w-72jm
What are Similar Vulnerabilities to BIT-mlflow-2024-3848?
Similar Vulnerabilities: CVE-2023-6909 , CVE-2023-46849 , CVE-2023-28432 , CVE-2022-22965 , CVE-2021-31566
