ben-slates/CVE-2024-37054

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2024-37054 that achieves remote code execution on MLflow Tracking Server by overwriting a model's python_model.pkl artifact with a malicious pickle payload and triggering deserialization via a prediction request.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python proof-of-concept exploit (poc.py) and its documentation (readme.md) for CVE-2024-37054, a pickle deserialization vulnerability in MLflow. The code implements a documented exploit chain: authenticate, upload training data, retrieve a run ID, overwrite a model artifact with a malicious pickle payload, and trigger deserialization to execute a user-supplied command or reverse shell. All behavior is consistent with the stated purpose of demonstrating the CVE. No concealed, deceptive, or unrelated harmful behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareMLflow
Attack typesDeserialization of Untrusted DataRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional Python script (poc.py) that implements a multi-step exploit chain to achieve remote code execution on a vulnerable MLflow server. The script generates a malicious pickle payload, uploads it to overwrite a model artifact, and triggers deserialization to execute arbitrary commands. The README explicitly describes it as a 'Proof-of-concept exploit'.

poc.py:1-644readme.md:9

Requirements

  • Network access to the MLflow Tracking Serverreadme.md:34
  • Valid MLflow credentials (default or otherwise)readme.md:35
  • Write access to artifacts (granted to all authenticated users)readme.md:36

Observed behavior

  • Authenticates to the target application using provided credentialspoc.py:319-357
  • Uploads a training CSV to register a new MLflow model versionpoc.py:359-403
  • Retrieves the run_id from the MLflow Tracking APIpoc.py:405-460
  • Overwrites the python_model.pkl artifact with a malicious pickle payload via HTTP PUTpoc.py:462-498
  • Triggers model deserialization by sending a prediction request, causing the pickle payload to executepoc.py:500-529
  • The pickle payload uses os.system() to execute a reverse shell or custom commandpoc.py:286-317
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
The exploit performs a multi-step attack: login, model registration, run ID retrieval, artifact overwrite with a pickle payload, and deserialization trigger.This is the documented exploit flow for CVE-2024-37054 and matches the vulnerability description.poc.py:198-211poc.py:531-597
Payload Generation
The payload is generated using pickle.dumps() with a __reduce__ method that calls os.system() with a user-provided command or a hardcoded reverse shell.This is the standard technique for pickle deserialization RCE and is explicitly described in the documentation.poc.py:286-317readme.md:46-51
Network Activity
The script makes HTTP requests to the target application and MLflow API endpoints for authentication, data upload, run search, artifact upload, and prediction triggering.All network activity is directed at the user-specified targets and is necessary for the exploit.poc.py:319-357poc.py:359-403poc.py:405-460poc.py:462-498poc.py:500-529
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the text evidence due to size budget; it is unlikely to contain exploit logic.
  • The evidence does not include any binary or non-text files.
  • One file (LICENSE) was omitted from the text evidence; its content is not reviewed, but it is typically a standard license file and unlikely to contain executable behavior.
  • Binary content was not present; the artifact consists solely of text files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1