MLflow permettait de mettre des fichiers arbitraires sur le serveur

The Arbitrary File Access vulnerability in MLflow allows an attacker to upload any file they choose to the MLflow server. This could be exploited to upload malicious code, such as a web shell, which would grant the attacker remote code execution capabilities. Alternatively, attackers could overwrite critical configuration files, disrupting MLflow's functionality or gaining access to sensitive data stored within the system. The potential impact extends beyond the MLflow instance itself, as a compromised server could be used as a pivot point for lateral movement within the network, potentially affecting other connected systems and data stores. The ability to upload arbitrary files bypasses standard security controls and represents a severe compromise of the system's integrity.

Organizations using MLflow for machine learning model tracking and management are at risk, particularly those running versions 2.8.0 or earlier. Environments with limited network segmentation or inadequate access controls are especially vulnerable, as a successful exploit could provide a foothold for broader network compromise. Teams relying on MLflow for sensitive data storage or model deployment should prioritize remediation.

• python / mlflow:

import mlflow
import requests

# Attempt to upload a file with a malicious filename
url = mlflow.tracking.MlflowClient().tracking_uri + '/data/artifacts/malicious.php' # Adjust URL as needed
files = {'file': open('malicious.php', 'rb')} # Replace with a test malicious file
response = requests.put(url, files=files)
print(response.status_code)

• generic web:

curl -X PUT -F "[email protected]" <mlflow_tracking_uri>/data/artifacts/malicious.php

• generic web: Check MLflow server logs for unusual file upload attempts or errors related to file access.

1. 2023-11-16Disclosure

   disclosure

1. Réservé2023-11-08
2. Publiée2023-11-16
3. Modifiée2024-02-16
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2023-6015 is to upgrade MLflow to version 2.8.1 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting file upload permissions on the MLflow server and closely monitoring file system activity for suspicious uploads. Implement a Web Application Firewall (WAF) with rules to block attempts to upload files to the MLflow API endpoints. Regularly scan the MLflow server for unauthorized files and review access controls to ensure only authorized users can upload files. After upgrading, confirm the fix by attempting a file upload via the MLflow API and verifying that the upload is rejected.