CVE-2023-6974
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in MLflow that allows attackers to make unauthorized requests to internal HTTP(s) servers. Attackers could potentially access sensitive internal services or achieve remote code execution in cloud environments like AWS instances. Organizations using vulnerable MLflow versions are affected.
💻 Affected Systems
- MLflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on victim machines, particularly in cloud environments where internal metadata services could be accessed to obtain credentials and escalate privileges.
Likely Case
Unauthorized access to internal HTTP(s) services, potentially exposing sensitive data or enabling lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and egress filtering preventing access to internal services.
🎯 Exploit Status
Exploitation requires the ability to interact with MLflow's API endpoints that process URLs. The vulnerability is well-documented in public bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 8174250f83352a04c2d42079f414759060458555 and subsequent releases
Vendor Advisory: https://github.com/mlflow/mlflow/commit/8174250f83352a04c2d42079f414759060458555
Restart Required: Yes
Instructions:
1. Update MLflow to a version containing the fix commit 8174250f83352a04c2d42079f414759060458555 or later. 2. Restart all MLflow services. 3. Verify the fix by checking the version and testing URL validation.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict MLflow server network access to prevent outbound requests to internal services
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
Input Validation Proxy
allDeploy a reverse proxy that validates and filters URL requests before they reach MLflow
🧯 If You Can't Patch
- Implement strict network egress filtering to prevent MLflow servers from accessing internal HTTP(s) services
- Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in requests to MLflow endpoints
🔍 How to Verify
Check if Vulnerable:
Check if your MLflow version predates commit 8174250f83352a04c2d42079f414759060458555 by examining the git history or version numberCheck Version:
mlflow --versionVerify Fix Applied:
Test URL validation by attempting to make requests to internal IP addresses (like 169.254.169.254) through MLflow's API endpoints📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from MLflow servers to internal IP addresses
- Requests to cloud metadata endpoints (169.254.169.254, 169.254.170.2)
Network Indicators:
- MLflow servers making HTTP requests to internal/private IP ranges
- Requests to known cloud provider metadata services
SIEM Query:
source="mlflow.log" AND (dest_ip=169.254.169.254 OR dest_ip IN [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16])