CVE-2024-37054

Classification basis

The artifact contains functional Python code that, when executed, logs a malicious model and then loads it to trigger arbitrary command execution. The README explicitly labels it as a 'Proof of Concept (PoC)' and provides step-by-step instructions to perform the attack. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

Requirements

• A vulnerable MLflow server (version 0.9.0 to <2.14.2) must be running and accessible.README.md:49Dockerfile:26
• The attacker must be able to log a model to the MLflow tracking server (no authentication required by default).poc/log_malicious_model.py:6poc/log_malicious_model.py:46-50
• The victim must load the malicious model using mlflow.pyfunc.load_model.poc/load_vulnerable_model.py:24

Observed behavior

• The attacker script defines a class with a __reduce__ method that returns (os.system, (cmd,)), where cmd is a shell command. When the model is logged, this object is pickled and stored on the MLflow server.poc/log_malicious_model.py:17-23
• The victim script loads the model using mlflow.pyfunc.load_model, which deserializes the pickled object via cloudpickle.load, causing the __reduce__ method to execute the attacker's shell command.poc/load_vulnerable_model.py:21-24README.md:48
• The payload creates a file named 'pwned.txt' and prints a message to confirm code execution.poc/log_malicious_model.py:22README.md:155

Observables

Exploit Payload

Payload withheldThe payload is the core of the CVE-2024-37054 PoC, designed to execute a harmless command (print message, create file) to confirm code execution.poc/log_malicious_model.py:22-23README.md:96-97

Vulnerable Dependency

Payload withheldThe Dockerfile installs a version of MLflow known to be vulnerable to CVE-2024-37054, which is the target of the PoC.Dockerfile:26

Classification basis

The artifact contains a complete, functional Python script (poc.py) that implements a multi-step exploit chain to achieve remote code execution on a vulnerable MLflow server. The script generates a malicious pickle payload, uploads it to overwrite a model artifact, and triggers deserialization to execute arbitrary commands. The README explicitly describes it as a 'Proof-of-concept exploit'.

Requirements

• Network access to the MLflow Tracking Serverreadme.md:34
• Valid MLflow credentials (default or otherwise)readme.md:35
• Write access to artifacts (granted to all authenticated users)readme.md:36

Observed behavior

• Authenticates to the target application using provided credentialspoc.py:319-357
• Uploads a training CSV to register a new MLflow model versionpoc.py:359-403
• Retrieves the run_id from the MLflow Tracking APIpoc.py:405-460
• Overwrites the python_model.pkl artifact with a malicious pickle payload via HTTP PUTpoc.py:462-498
• Triggers model deserialization by sending a prediction request, causing the pickle payload to executepoc.py:500-529
• The pickle payload uses os.system() to execute a reverse shell or custom commandpoc.py:286-317

Observables

Exploit Chain

Payload withheldThis is the documented exploit flow for CVE-2024-37054 and matches the vulnerability description.poc.py:198-211poc.py:531-597

Payload Generation

Payload withheldThis is the standard technique for pickle deserialization RCE and is explicitly described in the documentation.poc.py:286-317readme.md:46-51

Network Activity

Payload withheldAll network activity is directed at the user-specified targets and is necessary for the exploit.poc.py:319-357poc.py:359-403poc.py:405-460poc.py:462-498poc.py:500-529

Classification basis

The artifact contains a complete, multi-step exploit that actively exercises the CVE-2024-37054 vulnerability to achieve remote code execution. It includes account registration, payload generation, artifact upload, and trigger mechanisms, going beyond mere detection or scanning.

Requirements

• Network access to a target MLflow instance and associated web application.shell.py:26-27
• Valid credentials for the MLflow API (default admin:password) or ability to register an account on the target application.shell.py:31-32shell.py:40-76
• A listener (e.g., netcat) to receive the reverse shell connection.shell.py:181

Observed behavior

• Registers a new user account on the target web application and retrieves a session cookie.shell.py:40-76
• Uploads a CSV file to trigger model training and retrieves the MLflow run_id.shell.py:78-116
• Constructs a malicious pickle payload that executes a bash reverse shell command upon deserialization.shell.py:118-128
• Uploads the malicious pickle to the MLflow artifact store, overwriting the model's python_model.pkl.shell.py:130-146
• Triggers the /predict endpoint on the target application, causing the malicious model to be loaded and the reverse shell to execute.shell.py:148-159

Observables

Reverse Shell Payload

Payload withheldThe exploit constructs a reverse shell command using attacker-supplied LHOST and LPORT, which is the expected behavior for a CVE-2024-37054 PoC.shell.py:120malicious_payload.py:13

Pickle Deserialization Exploit

Payload withheldThe malicious pickle payload is designed to execute os.system with the reverse shell command upon deserialization, directly implementing the CVE-2024-37054 vulnerability.shell.py:122-126malicious_payload.py:15-17

Target Interaction

Payload withheldThe exploit interacts with the target application and MLflow server to upload the malicious model and trigger deserialization, all within the scope of the described exploit chain.shell.py:50-55shell.py:64-69shell.py:84-88shell.py:136-141shell.py:154-158

Classification basis

The artifact contains code that generates a malicious payload (generate_model.py) and uploads it to a vulnerable service (upload_model.py) with the explicit purpose of achieving remote code execution, as described in the README. This constitutes an exploit.

Requirements

• Valid MLflow credentials (username/password) to upload model artifacts.upload_model.py:4-5
• Network access to the target MLflow instance.upload_model.py:6
• A listener (e.g., netcat) to receive the reverse shell.README.md:23-25

Observed behavior

• Generates a malicious pickle file (model.pkl) containing a reverse shell payload.generate_model.py:6-12
• Uploads the malicious pickle and a crafted MLmodel file to an MLflow experiment run.upload_model.py:28-56
• Registers the uploaded model and transitions it to the Production stage.upload_model.py:58-82
• Instructs the user to trigger the payload by sending a POST request to the /predict endpoint, which deserializes the pickle and executes the reverse shell.README.md:37-47

Observables

Reverse Shell Payload

Payload withheldThe payload in generate_model.py creates a reverse shell connecting to a user-specified IP and port. This is the intended exploit behavior for CVE-2024-37054, not a hidden backdoor.generate_model.py:8

Pickle Deserialization Exploit

Payload withheldThe Exploit class uses Python's pickle __reduce__ to execute an arbitrary command upon deserialization. This is the standard technique for demonstrating CVE-2024-37054.generate_model.py:6-9

Model Upload And Promotion

Payload withheldThe script automates the steps to register a malicious model in MLflow, which is the expected attack chain for this CVE.upload_model.py:1-83

Classification basis

The artifact contains a complete, automated Python script (exploit.py) that actively exploits CVE-2024-37054 by uploading a malicious pickle payload and triggering its deserialization to achieve remote code execution. The README describes it as an exploit and provides usage examples for obtaining a reverse shell. The code includes payload construction (build_revshell_pickle), artifact poisoning (upload_pickle), and trigger mechanisms (trigger_load), which are hallmarks of an exploit, not a scanner or writeup.

Requirements

• Network access to an MLflow tracking server (versions 0.9.0 through 2.14.1) with valid credentials (HTTP Basic Auth).README.md:4exploit.py:39-40
• A registered MLflow model or the ability to trigger model training via the target application.exploit.py:148-164exploit.py:324-328
• An application endpoint that calls mlflow.pyfunc.load_model() on the poisoned model, or an alternative trigger mechanism.README.md:40exploit.py:232-243

Observed behavior

• Validates connectivity and credentials to the MLflow server by querying the registered-models/search API endpoint.exploit.py:48-75
• Enumerates registered MLflow models and their versions when run in 'list' mode.exploit.py:303-313
• Authenticates to a target web application (via login or throwaway account registration) to obtain a session cookie.exploit.py:79-144
• Triggers model training on the target application by uploading a CSV file, causing a new model to be registered in MLflow.exploit.py:148-164
• Resolves the experiment_id and run_id for a target model by querying MLflow REST APIs.exploit.py:168-198
• Constructs a malicious cloudpickle payload that executes a bash reverse shell command via os.system upon deserialization.exploit.py:202-207
• Uploads the malicious pickle to the MLflow artifact store, overwriting the model's python_model.pkl file.exploit.py:211-228
• Triggers the deserialization by sending a request to the application endpoint that loads the poisoned model, resulting in remote code execution.exploit.py:232-243exploit.py:362-366

Observables

Reverse Shell Payload

Payload withheldThe exploit builds a reverse shell command using attacker-supplied lhost and lport, which is the documented payload for the CVE.exploit.py:202-207

Target Application Interaction

Payload withheldThe script attempts to log into a target web application and falls back to registering a throwaway account to obtain a session cookie, which is then used to trigger model loading. This is part of the documented exploit workflow.exploit.py:79-144

Classification basis

The artifact is a writeup. It provides a substantive technical analysis of a penetration testing engagement, including reconnaissance, exploitation, and privilege escalation steps. It does not contain functional exploit or scanner code; the provided code snippets are illustrative and redacted. The README.md explicitly states it is a 'complete penetration testing walkthrough' and the index.html is a styled presentation of the same content.

Requirements

• Access to the target MLflow instance with default credentials (admin:password).README.md:101-106
• Ability to upload a malicious pickle payload to the MLflow model registry.README.md:111-121
• Write access to the /opt/tools/mlflow_ctl/plugins/dev/ directory for privilege escalation.README.md:198-201

Observed behavior

• Describes using default credentials to authenticate to an MLflow instance.README.md:101-106
• Describes creating a malicious pickle payload with a __reduce__ method to execute a reverse shell command.README.md:126-131
• Describes triggering the deserialization by sending a POST request to the /predict endpoint.README.md:140-143
• Describes using a bind shell to bypass an egress firewall.README.md:159-162
• Describes privilege escalation by creating a malicious .pth file and a fake mlflow_actions.py module to execute commands as root via sudo.README.md:218-235

Observables

Exploit Payload

Payload withheldA reverse shell payload used to gain initial access as part of the documented CVE-2024-37054 exploitation.README.md:130

Exploit Payload

Payload withheldA bind shell payload used to bypass an egress firewall, consistent with the described privilege escalation path.README.md:162

Privilege Escalation Command

Payload withheldA command used in the malicious Python module to set the SUID bit on /bin/bash for root privilege escalation.README.md:226