CVE-2024-37056
📋 TL;DR
This vulnerability allows remote code execution through malicious ML models in MLflow. Attackers can upload specially crafted LightGBM scikit-learn models that execute arbitrary code when loaded. Organizations using MLflow 1.23.0 or newer for model management are affected.
💻 Affected Systems
- MLflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, steal data, deploy ransomware, or pivot to other systems in the network.
Likely Case
Data exfiltration from MLflow servers, credential theft, and installation of backdoors for persistent access.
If Mitigated
Limited impact if proper network segmentation, model validation, and least privilege access controls are implemented.
🎯 Exploit Status
Exploitation requires ability to upload models to MLflow. The vulnerability is in the deserialization of pickle files within LightGBM models.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.14.0
Vendor Advisory: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
Restart Required: Yes
Instructions:
1. Upgrade MLflow to version 2.14.0 or later
2. Restart all MLflow services
3. Verify the upgrade was successful by checking the version
🔧 Temporary Workarounds
Disable LightGBM model loading
allTemporarily disable loading of LightGBM scikit-learn models until patching is complete
Configure MLflow to reject LightGBM model uploads at the API level
Implement model validation
allAdd validation layer to inspect models before loading
Implement pre-loading checks for pickle files in uploaded models
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MLflow servers from critical systems
- Enforce least privilege access controls and audit all model uploads
🔍 How to Verify
Check if Vulnerable:
Check MLflow version: if version is 1.23.0 or newer and less than 2.14.0, the system is vulnerableCheck Version:
mlflow --versionVerify Fix Applied:
Verify MLflow version is 2.14.0 or later and test that LightGBM model loading functions properly📡 Detection & Monitoring
Log Indicators:
- Unusual model uploads from unexpected sources
- Errors during model deserialization
- Suspicious command execution in MLflow logs
Network Indicators:
- Unexpected outbound connections from MLflow servers
- Large model uploads from untrusted sources
SIEM Query:
source="mlflow" AND (event="model_upload" OR event="model_load") | stats count by src_ip, model_type