CVE-2024-1483

HIGHNuclei

Path Traversal Vulnerability in mlflow/mlflow

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-1483 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 18, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

mflow

Browse mflow / mflow

Default status: unknown

CVE ListThrough *affected

mlflow/mlflow

Browse mlflow / mlflow/mlflow
CVE ListThrough latestaffected

mlflow

Browse PyPI / mlflow
GitHub AdvisoryBefore 2.12.1 · Fixed in 2.12.1affected

Nuclei templates

1
ProjectDiscoveryHIGHMlflow < 2.9.2 - Path TraversalCVSS 7.5

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.

Impact

Successful exploitation could be lead to disclose of sensitive information such as SSH Keys or Internal configurations.

Remediation

To fix this vulnerability, it is important to update the mlflow package to the latest version 2.10.0.

WeaknessesCWE-29
Authorsgy741
Template tagscvecve2024mlflowlfiintrusivelfprojectsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
Shodan: http.title:"mlflow"
FOFA: title="mlflow"
FOFA: app="mlflow"
Google: intitle:"mlflow"
https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d https://nvd.nist.gov/vuln/detail/CVE-2024-1483

Source: ProjectDiscovery

References

3