mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.
References
| Link | Resource |
|---|---|
| https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc | Patch |
| https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc | Patch |
| https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c | Exploit Issue Tracking Third Party Advisory |
| https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c | Exploit Issue Tracking Third Party Advisory |
Configurations
History
03 Feb 2025, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.3 |
| CWE | CWE-22 | |
| References | () https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc - Patch | |
| First Time |
Lfprojects
Lfprojects mlflow |
16 Apr 2024, 13:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-16 00:15
Updated : 2025-02-03 15:50
NVD link : CVE-2024-3573
Mitre link : CVE-2024-3573
JSON object : View
Products Affected
lfprojects
- mlflow
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')