PT-2024-21666 · Mlflow · Mlflow

Uriya Yavnieli · Published 2024-02-23 · Updated 2025-01-22 · CVE-2024-27133

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

The issue is with MLflow, which has a problem with insufficient sanitization, leading to XSS when running a recipe that uses an untrusted dataset. This can further result in a client-side RCE when the recipe is run in Jupyter Notebook. The affected software is MLflow, and the issue arises from a lack of sanitization of dataset table fields. An exploit for this issue is available, but the specific affected versions of MLflow are not specified. The issue can be exploited when running a recipe with an untrusted dataset, leading to XSS and potentially client-side RCE in Jupyter Notebook. #MLflow #XSS #RCE #JupyterNotebook #cybersecurityawareness #infosec #hacker

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MLFLOW-2024-27133

CVE-2024-27133

GHSA-3V79-Q7PH-J75H

PYSEC-2024-241

Affected Products

Mlflow

References · 16

• 🔥 https://research.jfrog.com/vulnerabilities/mlflow-untrusted-dataset-xss-jfsa-2024-000631932 · Exploit
• https://github.com/mlflow/mlflow/pull/10893 · Patch
• https://osv.dev/vulnerability/PYSEC-2024-241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27133 · Security Note
• https://osv.dev/vulnerability/BIT-mlflow-2024-27133 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3v79-q7ph-j75h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27133 · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://github.com/mlflow/mlflow/commit/c43823750bffa5b6abcc086683b15a068513b67b · Note
• https://github.com/mlflow/mlflow/commit/cfa71879a884cc3520e23ccab998c9aa78fdf2b1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-241.yaml · Note
• https://github.com/advisories/GHSA-3v79-q7ph-j75h · Note
• https://twitter.com/JFrogSecurity/status/1763196773424603590 · Twitter Post
• https://t.me/cvenotify/108200 · Telegram Post
• https://twitter.com/cracbot/status/1761610639179501962 · Twitter Post