NiteeshPujari/CVE-2024-37054-MLflow-RCE

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Proof of Concept (PoC) for CVE-2024-37054, a deserialization vulnerability in MLflow. It contains two Python scripts: one that logs a malicious model containing a pickled payload (poc/log_malicious_model.py), and another that loads the model, triggering arbitrary code execution via cloudpickle deserialization (poc/load_vulnerable_model.py). The README explicitly describes the steps to execute the attack and observe the RCE.

Backdoor review

No backdoor observed in reviewed code

The repository is a documented Proof of Concept for CVE-2024-37054, demonstrating a known MLflow deserialization vulnerability. The payload (os.system call) is explicitly described in the README and source code as the intended exploit demonstration. No concealed, unrelated, or operator-directed harmful behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonDockerfile
Target softwareMLflow
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains functional Python code that, when executed, logs a malicious model and then loads it to trigger arbitrary command execution. The README explicitly labels it as a 'Proof of Concept (PoC)' and provides step-by-step instructions to perform the attack. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

README.md:19README.md:34poc/log_malicious_model.py:1-53poc/load_vulnerable_model.py:1-30

Requirements

  • A vulnerable MLflow server (version 0.9.0 to <2.14.2) must be running and accessible.README.md:49Dockerfile:26
  • The attacker must be able to log a model to the MLflow tracking server (no authentication required by default).poc/log_malicious_model.py:6poc/log_malicious_model.py:46-50
  • The victim must load the malicious model using mlflow.pyfunc.load_model.poc/load_vulnerable_model.py:24

Observed behavior

  • The attacker script defines a class with a __reduce__ method that returns (os.system, (cmd,)), where cmd is a shell command. When the model is logged, this object is pickled and stored on the MLflow server.poc/log_malicious_model.py:17-23
  • The victim script loads the model using mlflow.pyfunc.load_model, which deserializes the pickled object via cloudpickle.load, causing the __reduce__ method to execute the attacker's shell command.poc/load_vulnerable_model.py:21-24README.md:48
  • The payload creates a file named 'pwned.txt' and prints a message to confirm code execution.poc/log_malicious_model.py:22README.md:155
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
os.system('echo ">>> RCE PAYLOAD EXECUTED SUCCESSFULLY <<<" && echo > pwned.txt')The payload is the core of the CVE-2024-37054 PoC, designed to execute a harmless command (print message, create file) to confirm code execution.poc/log_malicious_model.py:22-23README.md:96-97
Vulnerable Dependency
mlflow==2.14.1The Dockerfile installs a version of MLflow known to be vulnerable to CVE-2024-37054, which is the target of the PoC.Dockerfile:26
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the text evidence; it is unlikely to contain exploit code.
  • The evidence does not include the execution output or confirmation that the code was run successfully.
  • One file (LICENSE) was omitted from the text evidence; its content is not available for review, but it is typically a standard license file and unlikely to contain executable behavior.
  • The review is limited to the supplied text files; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2024-37054Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized MLflow 2.14.1 server intended as a vulnerable target for CVE-2024-37054 deserialization RCE. The image runs as non-root user 'nit' and serves the MLflow UI on port 5000.

Dockerfile:1-33

Lab assessment

Vulnerability lab

The README explicitly states this is a Proof of Concept for CVE-2024-37054, a deserialization vulnerability in MLflow. The Dockerfile installs a vulnerable version (2.14.1) and the repository includes attacker and victim scripts to demonstrate RCE.

README.md:1-179Dockerfile:24
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

MLflow Server

vulnerable targetmodel registry

A container running MLflow 2.14.1 UI on port 5000, using a file-based backend store at /home/nit/mlruns. It is the target for the deserialization exploit.

Dockerfile:24-33

Attacker Script (log_malicious_model.py)

exploit delivery

A Python script that connects to the MLflow server, crafts a malicious model containing a pickled payload (os.system call), and logs it to the server. The payload creates a file 'pwned.txt' and prints a message.

poc/log_malicious_model.py:1-53

Victim Script (load_vulnerable_model.py)

exploit trigger

A Python script that connects to the MLflow server and loads the malicious model using mlflow.pyfunc.load_model, triggering deserialization of the payload and executing the attacker's command.

poc/load_vulnerable_model.py:1-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-37054

Supported by supplied evidence

The README describes CVE-2024-37054 as a deserialization vulnerability in mlflow.pyfunc.load_model affecting versions up to 2.14.1. The Dockerfile installs mlflow==2.14.1, and the PoC scripts demonstrate RCE via a malicious pickled model, consistent with the CVE description.

README.md:1-179Dockerfile:24poc/log_malicious_model.py:1-53poc/load_vulnerable_model.py:1-30
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:60-65
  • A vulnerable version of mlflow (2.14.1) must be installed locally to run the attacker and victim scripts.README.md:72
  • The MLflow server must be running and accessible at http://127.0.0.1:5000.README.md:60-65poc/log_malicious_model.py:5

Evidence-described exercise path

  1. Build the Docker image: docker build -t mlflow-vulnerable .README.md:62-63
  2. Run the container: docker run -p 5000:5000 --name mlflow-poc-server -it mlflow-vulnerableREADME.md:65
  3. Run the attacker script: python poc/log_malicious_model.pyREADME.md:100
  4. Run the victim script: python poc/load_vulnerable_model.pyREADME.md:120
  5. Observe the RCE payload execution: a message is printed and pwned.txt is created.README.md:123-125
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The payload in the attacker script only echoes a message and creates a file named pwned.txt. It does not target the host, exfiltrate data, establish persistence, or perform any destructive action. The Dockerfile runs as a non-root user and does not mount the Docker socket or use privileged mode. All behavior is contained within the lab's intended demonstration of CVE-2024-37054.

poc/log_malicious_model.py:17-19Dockerfile:1-33
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1