CVE-2024-37052
📋 TL;DR
This vulnerability allows remote code execution through malicious ML models in MLflow. Attackers can upload specially crafted scikit-learn models that execute arbitrary code when loaded. Organizations using MLflow 1.1.0+ for model serving or experimentation are affected.
💻 Affected Systems
- MLflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, deploy ransomware, or pivot to other systems.
Likely Case
Data exfiltration from MLflow servers, credential theft, or deployment of cryptocurrency miners on vulnerable systems.
If Mitigated
Limited impact with proper network segmentation, model validation, and least privilege access controls.
🎯 Exploit Status
Exploitation requires ability to upload models to MLflow. Attackers with user accounts or compromised credentials can exploit this.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12.1
Vendor Advisory: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
Restart Required: Yes
Instructions:
1. Upgrade MLflow to version 2.12.1 or later. 2. Update all MLflow components (tracking server, model registry). 3. Restart MLflow services. 4. Verify no vulnerable versions remain in your environment.
🔧 Temporary Workarounds
Restrict Model Uploads
allTemporarily disable or restrict scikit-learn model uploads to MLflow
# Configure MLflow to reject scikit-learn model uploads
# Modify MLflow configuration to restrict model types
Network Segmentation
allIsolate MLflow servers from sensitive systems and internet
# Configure firewall rules to restrict MLflow access
# Implement network segmentation for MLflow environment
🧯 If You Can't Patch
- Implement strict access controls to MLflow - only allow trusted users to upload models
- Deploy runtime application self-protection (RASP) or WAF with deserialization protection
🔍 How to Verify
Check if Vulnerable:
Check MLflow version: if version >= 1.1.0 and < 2.12.1, system is vulnerableCheck Version:
mlflow --versionVerify Fix Applied:
Confirm MLflow version is 2.12.1 or higher and test model loading functionality📡 Detection & Monitoring
Log Indicators:
- Unusual model uploads from unexpected sources
- Multiple failed model loading attempts
- Suspicious file paths in model artifacts
Network Indicators:
- Unusual outbound connections from MLflow servers
- Large data transfers from MLflow to external IPs
SIEM Query:
source="mlflow" AND (event="model_upload" OR event="model_load") | stats count by src_ip, user