mlflow Pfadüberschreitungs-Vulnerabilität

The path traversal vulnerability in MLflow allows an attacker to bypass intended access controls and read arbitrary files on the server hosting the MLflow tracking server. By crafting malicious HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the directory structure. This could lead to the exposure of sensitive data such as configuration files, credentials, or even application code. The potential blast radius extends to any data stored or processed by the MLflow server, depending on the server's permissions and configuration. While no direct precedent exists for this specific vulnerability, path traversal vulnerabilities are frequently exploited to gain unauthorized access to systems and data.

Organizations utilizing MLflow for machine learning model tracking and management, particularly those running versions 2.9.2 or earlier, are at risk. Shared hosting environments where multiple users share the same MLflow instance are especially vulnerable, as an attacker could potentially exploit the vulnerability to access data belonging to other users.

• python / mlflow:

import requests

url = 'http://your-mlflow-server/tracking/api/v2/artifacts'
headers = {'Content-Type': 'application/json'}
payload = {
    'artifact_location': '../sensitive_file.txt#',
    'source': 'local'
}
response = requests.post(url, headers=headers, json=payload)
print(response.status_code, response.text)

• linux / server: journalctl filters for HTTP POST requests to /tracking/api/v2/artifacts with unusual parameters. • generic web: Check access/error logs for HTTP POST requests to /tracking/api/v2/artifacts containing artifact_location or source parameters with '../' sequences.

1. 2024-04-16Disclosure

   disclosure

1. Reserviert2024-02-13
2. Veröffentlicht2024-04-16
3. Geändert2025-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-1483 is to upgrade MLflow to version 2.12.1 or later, which contains the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict access to the MLflow tracking server to trusted networks and users. Implement strict input validation on the 'artifact_location' and 'source' parameters to prevent malicious path manipulation. Consider using a Web Application Firewall (WAF) to filter out requests containing suspicious path traversal patterns. Monitor MLflow server logs for unusual file access attempts.