CVE-2024-3573
📋 TL;DR
This vulnerability in MLflow allows attackers to perform Local File Inclusion (LFI) by exploiting improper URI parsing in the 'is_local_uri' function. Attackers can craft malicious model versions with specially crafted 'source' parameters to read arbitrary files on the system, potentially exposing sensitive data. All MLflow deployments using vulnerable versions are affected.
💻 Affected Systems
- mlflow/mlflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading of sensitive files like SSH keys, configuration files, or database credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized reading of sensitive files within the server's directory structure, exposing configuration files, logs, or other sensitive data.
If Mitigated
Limited file access restricted by server permissions, but still potential for information disclosure.
🎯 Exploit Status
Exploitation requires ability to create or modify model versions in MLflow. The vulnerability is well-documented in public bug bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions including commit 438a450714a3ca06285eeea34bdc6cf79d7f6cbc
Vendor Advisory: https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
Restart Required: Yes
Instructions:
1. Update MLflow to version containing fix commit 438a450714a3ca06285eeea34bdc6cf79d7f6cbc
2. Restart MLflow services
3. Verify the fix by testing URI parsing functionality
🔧 Temporary Workarounds
Restrict Model Version Creation
allLimit who can create or modify model versions in MLflow to trusted users only.
Network Segmentation
allPlace MLflow behind authentication and restrict network access to trusted IPs only.
🧯 If You Can't Patch
- Implement strict access controls on MLflow endpoints
- Monitor for unusual file access patterns or model version creation attempts
🔍 How to Verify
Check if Vulnerable:
Check MLflow version and compare with fix commit 438a450714a3ca06285eeea34bdc6cf79d7f6cbc. Test URI parsing with empty or 'file' scheme URIs.Check Version:
mlflow --versionVerify Fix Applied:
After patching, test that the 'is_local_uri' function properly handles URIs with empty or 'file' schemes and prevents LFI attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual model version creation attempts
- File access patterns outside expected directories
- URI parsing errors in logs
Network Indicators:
- Requests with crafted 'source' parameters in model version creation
- Unusual file read patterns from MLflow server
SIEM Query:
source="mlflow" AND (uri_parsing_error OR model_version_creation) AND (file_scheme OR empty_uri)