CVE-2024-37054

This repository contains a functional exploit for CVE-2024-37054, targeting MLflow's pickle deserialization vulnerability. The exploit chain includes authentication, model upload, and payload execution via a malicious pickle file.

This repository contains a functional Proof of Concept (PoC) for CVE-2024-37054, demonstrating a deserialization vulnerability in MLflow that allows Remote Code Execution (RCE). The PoC includes scripts to log a malicious model and load it, triggering arbitrary command execution.

The repository contains only a minimal README with a title and brief description of CVE-2024-37054, but no actual exploit code, technical details, or proof-of-concept implementation.

The repository contains a functional exploit for CVE-2024-37054, which leverages unsafe deserialization in MLflow's pyfunc module to achieve remote code execution. The exploit automates the process of discovering models, uploading a malicious pickle payload, and triggering its execution.

This repository contains a functional exploit for CVE-2024-37054, leveraging pickle deserialization in MLflow to achieve unauthenticated remote code execution (RCE). The exploit generates a malicious pickle file with a reverse shell payload, uploads it to MLflow, and promotes it to Production, triggering execution upon a prediction request.

This repository contains a functional exploit for CVE-2024-37054, a deserialization vulnerability in MLflow versions 0.9.0 to 2.14.1. The exploit leverages malicious pickle payloads to achieve remote code execution when a pyfunc model is loaded via `mlflow.pyfunc.load_model()`.