CVE-2024-8859
📋 TL;DR
A path traversal vulnerability in MLflow 2.15.1 allows attackers to read arbitrary files when the DBFS service is configured and mounted locally. This occurs because URL query parameters aren't properly validated during file protocol concatenation. Users who have configured DBFS service mounting are affected.
💻 Affected Systems
- mlflow/mlflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system compromise including sensitive configuration files, credentials, and application data
Likely Case
Unauthorized reading of application files, configuration data, and potentially sensitive user data
If Mitigated
Limited to reading files accessible by the MLflow process user account
🎯 Exploit Status
Requires knowledge of DBFS configuration and ability to craft malicious URLs with path traversal sequences
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 and later versions
Vendor Advisory: https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654
Restart Required: No
Instructions:
1. Update MLflow to version after commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654
2. Verify DBFS URL validation now properly handles query parameters
3. No service restart required for configuration changes
🔧 Temporary Workarounds
Disable DBFS mounting
allTemporarily disable DBFS service mounting until patched
# Configure MLflow without DBFS mounting
# Review mlflow configuration files and remove DBFS mount configurations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MLflow instances
- Apply strict file system permissions to limit MLflow process access
🔍 How to Verify
Check if Vulnerable:
Check if using MLflow 2.15.1 with DBFS service configured and mounted locallyCheck Version:
pip show mlflow | grep VersionVerify Fix Applied:
Verify MLflow version is after commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 and test DBFS URL handling📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from MLflow process
- Failed path traversal attempts in application logs
Network Indicators:
- Suspicious URL patterns with ../ sequences in DBFS requests
SIEM Query:
source="mlflow" AND (url="*../*" OR url="*..\\*" OR url="*%2e%2e%2f*")