CVE-2023-3765
published 2023-07-19CVE-2023-3765: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
PriorityP277critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EXPLOIT
EPSS
70.74%
99.3th percentile
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lfprojects | mlflow | < 2.5.0 | 2.5.0 |
| lfprojects | mlflow | < 6dde93758d42455cb90ef324407919ed67668b9b | 6dde93758d42455cb90ef324407919ed67668b9b |
| lfprojects | mlflow | >= 0 < 2.5.0 | 2.5.0 |
| lfprojects | mlflow | >= 0 < 6dde93758d42455cb90ef324407919ed67668b9b | 6dde93758d42455cb90ef324407919ed67668b9b |
| mlflow | mlflow_mlflow | >= unspecified < 2.5.0 | 2.5.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →HTTP GET request to the MLflow artifacts API endpoint with an absolute Windows path (C:/) as the 'path' parameter indicates exploitation of the path traversal vulnerability. ↗
- →A successful exploit response returns HTTP 200 with a JSON body containing the keys 'is_dir', 'path', and 'files', indicating directory listing of an absolute path on the server. ↗
- →The exploit response Content-Type header will be 'application/json', which can be used as an additional confirmation signal in detection rules. ↗
- →Shodan/FOFA/Google dork queries can be used to identify exposed MLflow instances: Shodan 'http.title:"mlflow"', FOFA 'title="mlflow"' or 'app="mlflow"', Google 'intitle:"mlflow"'. ↗
- ·The exploit path shown uses a Windows absolute path (C:/). The vulnerability may also be exploitable on Linux hosts using Unix-style absolute paths (e.g., /etc/passwd). Detection rules should account for both path formats. ↗
- ·The vulnerability affects MLflow versions prior to 2.5.0 only. Instances running 2.5.0 or later are not affected. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
MLflow Path Traversal vulnerability
ghsa·2023-07-19
CVE-2023-3765 [CRITICAL] CWE-36 MLflow Path Traversal vulnerability
MLflow Path Traversal vulnerability
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
OSV
CVE-2023-3765: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2
osv·2023-07-19
CVE-2023-3765 CVE-2023-3765: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
OSV
MLflow Path Traversal vulnerability
osv·2023-07-19
CVE-2023-3765 [CRITICAL] MLflow Path Traversal vulnerability
MLflow Path Traversal vulnerability
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
No detection rules found.
Nuclei
MLflow Absolute Path Traversal
nuclei·CVSS 10.0
CVE-2023-3765 [CRITICAL] MLflow Absolute Path Traversal
MLflow Absolute Path Traversal
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
Template:
id: CVE-2023-3765
info:
name: MLflow Absolute Path Traversal
author: DhiyaneshDK
severity: critical
description: |
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
impact: |
This vulnerability can lead to unauthorized access to sensitive information stored on the server.
remediation: |
Upgrade to a patched version of MLflow to mitigate the Absolute Path Traversal vulnerability.
reference:
- https://www.tenable.com/cve/CVE-2023-3765
- https://huntr.dev/bounties/4be5fd63-8a0a-490d-9ee1-f33dc768ed76
- https://nvd.nist.gov/vuln/detail/CVE-2023-3765
- https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b
classification:
cvss
No writeups or analysis indexed.
2023-07-19
Published