CVE-2024-3099

Executive Summary

CVE-2024-3099 is a vulnerability in MLflow version 2.11.1 that allows an authenticated attacker to create multiple models with the same name by exploiting URL encoding. This flaw stems from inadequate validation of model names, where URL-encoded names are treated as distinct from their URL-decoded counterparts. The impact includes Denial of Service (DoS) and data model poisoning. An authenticated user may be unable to use the intended model, as it will open a different model each time. Additionally, an attacker can create a poisoned model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The CVSS score is 5.4 (Medium), with a low EPSS score of 0.0%. No public exploit code or patch is currently available.

Supply Chain & Package Security

MLflow is a Python package available on PyPI. This vulnerability affects the MLflow server component, which is used to manage and serve machine learning models. Organizations using MLflow in their MLOps pipelines should be aware of this issue, as it can lead to model confusion and potential data poisoning in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must use the poisoned model)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (data model poisoning)
• Availability Impact: Low (Denial of Service)

Deep Dive & Mechanics

The vulnerability lies in the model name validation logic within MLflow's REST API. When a user creates a model via the API, the model name is URL-decoded before being stored. However, the validation check does not account for URL-encoded characters. An attacker can send a request with a URL-encoded model name (e.g., %6D%79%6D%6F%64%65%6C for "mymodel") that bypasses the uniqueness check, allowing the creation of a duplicate model entry. When an authenticated user later attempts to access the model by its decoded name, the system may return the attacker's poisoned model instead of the legitimate one.

The attack flow:

1. Attacker authenticates to the MLflow server.
2. Attacker sends a POST request to create a model with a URL-encoded name that decodes to the same name as an existing model.
3. The server accepts the request, creating a duplicate model entry.
4. When a legitimate user tries to access the model by its decoded name, the server may return the attacker's model, leading to data poisoning or DoS.

Vulnerable vs. Patched Code

Vulnerable Code (MLflow 2.11.1):

# In mlflow/store/tracking/rest_store.py or similar
def create_model(self, name, ...):
    # No URL decoding or normalization before validation
    if self._model_exists(name):
        raise MlflowException("Model already exists")
    # Store the name as-is
    self._create_model_in_db(name, ...)

Patched Code (Hypothetical):

# In mlflow/store/tracking/rest_store.py
import urllib.parse

def create_model(self, name, ...):
    # Normalize the name by URL decoding
    decoded_name = urllib.parse.unquote(name)
    if self._model_exists(decoded_name):
        raise MlflowException("Model already exists")
    # Store the decoded name
    self._create_model_in_db(decoded_name, ...)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an MLflow server (version 2.11.1) with authentication enabled.
• Valid credentials for an authenticated user.

Exploitation Steps:

1. Identify an existing model name (e.g., my_model).
2. URL-encode the model name: %6D%79%5F%6D%6F%64%65%6C (for "my_model").
3. Send a POST request to create a new model with the URL-encoded name:

   curl -X POST "http://mlflow-server:5000/api/2.0/mlflow/registered-models/create" \
     -H "Content-Type: application/json" \
     -d '{"name": "%6D%79%5F%6D%6F%64%65%6C"}'
   

4. The server creates a duplicate model entry.
5. Upload a malicious model version to the duplicate entry.
6. When a victim uses the model name my_model, they may be served the malicious version.

Blue Team

Detection:

• Monitor API logs for requests with URL-encoded characters in model names.
• Alert on multiple model creation requests with the same decoded name.
• Use the detection rules provided below.

Mitigation:

• Apply input validation to URL-decode model names before processing.
• Implement strict uniqueness checks on decoded names.
• Restrict model creation to trusted users only.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/2.0/mlflow/registered-models/create with URL-encoded model names.
• Logs: Multiple model entries with the same decoded name in the MLflow database.
• File System: Unusual model artifacts in the MLflow artifact store.

Detection Engineering

YARA Rule

rule mlflow_model_name_encoding_abuse {
    meta:
        description = "Detects URL-encoded model names in MLflow API requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3099"
    strings:
        $url_encoded = /%[0-9a-fA-F]{2}/ 
        $model_create = "registered-models/create"
    condition:
        $model_create and #url_encoded > 2
}

Sigma Rule

title: MLflow Model Name Encoding Abuse
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to create MLflow models with URL-encoded names
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: mlflow
detection:
    selection:
        event: "registered-models/create"
        request_body|contains:
            - "%2F"
            - "%3A"
            - "%40"
            - "%2E"
            - "%5F"
    condition: selection
falsepositives:
    - Legitimate use of special characters in model names
level: medium

Suricata Rule

alert http any any -> any any (msg:"MLflow Model Name Encoding Abuse"; flow:to_server; content:"POST"; http_method; content:"/api/2.0/mlflow/registered-models/create"; http_uri; pcre:"/%[0-9a-fA-F]{2}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable model creation for untrusted users. Implement strict input validation to URL-decode model names before processing.
2. Short-term: Apply a WAF rule to block requests with URL-encoded characters in model names.
3. Long-term: Upgrade to a patched version of MLflow once available. Monitor the MLflow GitHub repository for updates.
4. Compensating Controls: Enable audit logging and monitor for duplicate model names. Implement model versioning and integrity checks.

Report generated by Valters IT DevSecOps & CTI Division