CVE-2023-6753
📋 TL;DR
This path traversal vulnerability in MLflow allows attackers to read arbitrary files on the server by manipulating file paths in requests. It affects all MLflow deployments running versions prior to 2.9.2. The vulnerability is particularly dangerous in multi-tenant environments where users can access each other's files.
💻 Affected Systems
- MLflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files with credentials, or database connection strings, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive ML model artifacts, experiment data, or configuration files belonging to other users in multi-tenant deployments.
If Mitigated
Limited impact with proper network segmentation, file system permissions, and minimal sensitive data exposure.
🎯 Exploit Status
The vulnerability is simple to exploit with basic HTTP requests. Public proof-of-concept exists in the commit diff and bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.2 and later
Vendor Advisory: https://github.com/mlflow/mlflow/commit/1c6309f884798fbf56017a3cc808016869ee8de4
Restart Required: Yes
Instructions:
1. Stop MLflow service. 2. Upgrade MLflow using pip: 'pip install --upgrade mlflow>=2.9.2'. 3. Restart MLflow service. 4. Verify the version with 'mlflow --version'.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to MLflow instances using firewalls or network policies
File System Permissions
linuxRun MLflow with minimal file system permissions and isolate sensitive directories
chmod 700 /sensitive/paths
chown mlflow:mlflow /mlflow/data
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MLflow from sensitive systems
- Deploy a web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check if MLflow version is below 2.9.2 using 'mlflow --version' or examine the installed package versionCheck Version:
mlflow --versionVerify Fix Applied:
Confirm MLflow version is 2.9.2 or higher and test that path traversal attempts return proper error responses📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences
- Access to unexpected file paths in MLflow logs
- Error responses for invalid file paths
Network Indicators:
- HTTP requests with path traversal patterns to MLflow endpoints
- Unusual file access patterns from single IPs
SIEM Query:
source="mlflow.log" AND ("../" OR "..\\" OR "%2e%2e%2f")