PT-2024-28025 · Mlflow · Mlflow

Weichen Xu · Published 2024-05-16 · Updated 2025-01-27 · CVE-2024-3848

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mlflow/mlflow version 2.11.0

Description A path traversal issue exists due to insufficient validation of the fragment portion of artifact URLs. An attacker can exploit this by inserting a '#' character into the URL fragment, allowing them to bypass validation and construct a URL that ignores the protocol scheme. This enables arbitrary file read, including sensitive information such as SSH and cloud keys, by manipulating the URL's conversion into a filesystem path.

Recommendations For mlflow/mlflow version 2.11.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-29

CWE-22

Related Identifiers

BIT-MLFLOW-2024-3848

CVE-2024-3848

GHSA-RFQQ-WQ6W-72JM

PYSEC-2024-244

Affected Products

Mlflow

References · 9

• 🔥 https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610 · Exploit
• https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8 · Patch
• https://osv.dev/vulnerability/GHSA-rfqq-wq6w-72jm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3848 · Security Note
• https://osv.dev/vulnerability/BIT-mlflow-2024-3848 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-3848 · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-244.yaml · Note