mlflow anfällig für Path Traversal

The path traversal vulnerability in MLflow allows an attacker to bypass security checks and access files outside of the intended directory. By crafting a malicious source parameter, an attacker can manipulate the model version creation process, leading to arbitrary file reads. This could expose sensitive data such as configuration files, API keys, or even model artifacts containing proprietary information. Successful exploitation could lead to a significant compromise of the MLflow server and the data it manages. The impact is amplified if the MLflow server is deployed in a production environment or handles sensitive machine learning data.

Organizations deploying MLflow for machine learning model management, particularly those using older versions (≤2.9.2), are at risk. Shared hosting environments where multiple users share the same MLflow instance are especially vulnerable, as an attacker could potentially access data belonging to other users. Environments with weak access controls to the MLflow tracking server are also at increased risk.

• python / mlflow:

import os
import mlflow

# Attempt to read a file outside the intended directory
try:
    mlflow.tracking.MlflowClient().create_model_version('model', '1', source='../../../../../../etc/passwd')
    print('Potential vulnerability detected!')
except Exception as e:
    print(f'Error: {e}')

• generic web: Check MLflow server logs for requests containing path traversal sequences (e.g., '../'). • generic web: Monitor network traffic to the MLflow server for suspicious requests targeting the /tracking/model-versions endpoint.

1. 2024-04-16Disclosure

   disclosure

1. Reserviert2024-02-15
2. Veröffentlicht2024-04-16
3. Geändert2025-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-1558 is to upgrade MLflow to version 2.12.1 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting access to the MLflow server, implementing stricter input validation on the source parameter, or using a Web Application Firewall (WAF) to filter out malicious requests. Monitor MLflow logs for suspicious activity, particularly requests containing unusual characters or path manipulations. After upgrading, confirm the fix by attempting to access a non-existent file via the model version creation endpoint and verifying that access is denied.