CVE-2024-27133

The impact of CVE-2024-27133 is significant due to the potential for client-side RCE. An attacker could craft a malicious dataset that, when used in an MLflow recipe, injects arbitrary JavaScript code into the Jupyter Notebook environment. This code could then be executed by the user running the recipe, granting the attacker control over the user's session and potentially the underlying system. The attacker could steal credentials, install malware, or perform other malicious actions. The blast radius extends to any user running recipes with untrusted datasets in affected MLflow installations. This vulnerability shares similarities with other XSS attacks that leverage recipe execution environments to achieve code execution.

Organizations heavily reliant on MLflow for machine learning workflows, particularly those using Jupyter Notebooks and incorporating external or untrusted datasets into their recipes, are at significant risk. Teams using shared MLflow instances or those with less stringent data governance practices are also more vulnerable.

• python / mlflow:

import mlflow
# Check MLflow version
print(mlflow.__version__)
# Check for suspicious recipe configurations or dataset sources
# Review Jupyter Notebook logs for unusual JavaScript execution

• generic web: • Check for unusual JavaScript execution in Jupyter Notebook logs. • Monitor for suspicious network activity originating from Jupyter Notebook processes.

1. 2024-02-23Disclosure

   disclosure

1. आरक्षित2024-02-20
2. प्रकाशित2024-02-23
3. संशोधित2025-04-08
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-27133 is to upgrade MLflow to version 2.10.0 or later, which includes the necessary sanitization fixes. If upgrading immediately is not feasible, consider restricting the use of untrusted datasets within MLflow recipes. Implement strict input validation and sanitization on any data sources used by recipes. Monitor Jupyter Notebook activity for suspicious JavaScript execution. While a WAF is unlikely to directly address this vulnerability, it can help detect and block malicious payloads. After upgrading, confirm the fix by running a recipe with a known malicious dataset and verifying that the injected JavaScript is properly sanitized and does not execute.