CVE-2024-4263

Executive Summary

CVE-2024-4263 is a broken access control vulnerability in MLflow, an open-source platform for the machine learning lifecycle. The flaw allows low-privilege users with only EDIT permissions on an experiment to delete any artifacts. This contradicts the intended permission model, where EDIT users should only be able to read and update artifacts, not delete them. The vulnerability arises from insufficient validation of DELETE requests, enabling unauthorized artifact deletion. The CVSS score is 5.4 (Medium), with a low attack complexity and no user interaction required. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the vulnerability is publicly known and should be addressed promptly.

Supply Chain & Package Security

MLflow is distributed as a Python package (PyPI). Organizations using MLflow should verify their installed version and update to 2.10.1 or later. The vulnerability affects the core artifact management functionality, which is critical for ML experiment reproducibility and data integrity. Supply chain risks include potential data loss or corruption of ML artifacts, which could impact model training and deployment pipelines.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (EDIT permission)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized deletion)
• Availability Impact: Low (deletion of artifacts)

The threat level is medium due to the low privileges required and the potential for data loss. However, the impact is limited to integrity and availability of artifacts, not confidentiality.

Deep Dive & Mechanics

The vulnerability exists in the artifact deletion endpoint of MLflow. When a user with EDIT permissions sends a DELETE request to delete an artifact, the server fails to verify that the user has the necessary DELETE permission. The code likely checks for EDIT permission but does not enforce a separate DELETE permission check. This allows any user with EDIT access to delete artifacts, including directories, which should be restricted to users with MANAGE or DELETE permissions.

The flaw is in the authorization logic for the artifact deletion API. The server should validate that the requesting user has a role that explicitly allows deletion (e.g., MANAGE or DELETE permission), but it incorrectly allows EDIT users to perform deletions.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.10.1):

# Hypothetical vulnerable implementation
def delete_artifact(experiment_id, artifact_path, user):
    if not user.has_permission(experiment_id, Permission.EDIT):
        raise PermissionError("Insufficient permissions")
    # Proceed with deletion without checking DELETE permission
    artifact_store.delete(artifact_path)

Patched Code (2.10.1+):

# Patched implementation
def delete_artifact(experiment_id, artifact_path, user):
    if not user.has_permission(experiment_id, Permission.DELETE):
        raise PermissionError("Insufficient permissions")
    # Only users with DELETE permission can proceed
    artifact_store.delete(artifact_path)

The patch adds a specific check for DELETE permission instead of relying on EDIT permission.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an MLflow instance with an experiment where the attacker has EDIT permissions.
• Knowledge of the artifact path to delete.

Exploitation Steps:

1. Authenticate to the MLflow instance with a user that has EDIT permissions on a target experiment.
2. Identify an artifact path (e.g., experiment/123/artifact/directory).
3. Send a DELETE request to the artifact deletion endpoint:

   DELETE /api/2.0/mlflow/artifacts/delete HTTP/1.1
   Host: mlflow.example.com
   Content-Type: application/json
   Authorization: Bearer <token>
   
   {
     "experiment_id": "123",
     "path": "directory"
   }
   

4. The server will delete the artifact without proper authorization.

Expected Outcome: The artifact is deleted, demonstrating the broken access control.

Blue Team

Detection:

• Monitor for DELETE requests to /api/2.0/mlflow/artifacts/delete from users with only EDIT permissions.
• Alert on unusual deletion patterns, especially bulk deletions or deletions of critical artifacts.

Mitigation:

• Immediately upgrade to MLflow 2.10.1 or later.
• If upgrade is not possible, implement a reverse proxy or WAF rule to block DELETE requests to the artifact endpoint from users without explicit DELETE permissions.
• Review user permissions and ensure least privilege principle is applied.

Indicators of Compromise (IOCs)

• Network: HTTP DELETE requests to /api/2.0/mlflow/artifacts/delete with a valid session token but from a user with EDIT permissions.
• Logs: MLflow audit logs showing artifact deletion events by users with EDIT permissions.
• File System: Missing artifacts or directories in the artifact store that were not intentionally deleted.

Detection Engineering

YARA Rule

rule CVE_2024_4263_MLflow_Artifact_Delete {
    meta:
        description = "Detects MLflow artifact deletion requests with insufficient permissions"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-4263"
    strings:
        $delete_endpoint = "/api/2.0/mlflow/artifacts/delete"
        $edit_permission = "EDIT"
    condition:
        $delete_endpoint and $edit_permission
}

Sigma Rule

title: MLflow Artifact Deletion by EDIT User
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DELETE requests to MLflow artifact endpoint from users with EDIT permissions
author: Valters IT
logsource:
    category: web
    product: mlflow
detection:
    selection:
        http.method: DELETE
        http.url: /api/2.0/mlflow/artifacts/delete
        user.permission: EDIT
    condition: selection
falsepositives:
    - Legitimate deletion by users with EDIT permission if misconfigured
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-4263 MLflow Artifact Deletion by EDIT User";
    flow:to_server;
    http.method; content:"DELETE";
    http.uri; content:"/api/2.0/mlflow/artifacts/delete";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MLflow to version 2.10.1 or later.
2. If upgrade is not possible, implement a WAF rule to block DELETE requests to /api/2.0/mlflow/artifacts/delete from users without DELETE permissions.
3. Review and audit all user permissions, ensuring that only users with MANAGE or DELETE roles can delete artifacts.

Long-term Measures:

• Implement role-based access control (RBAC) with granular permissions for artifact operations.
• Enable audit logging for all artifact operations and monitor for anomalies.
• Conduct regular security reviews of MLflow configurations and permissions.

Workarounds:

• Use a reverse proxy to enforce additional authorization checks before forwarding DELETE requests to MLflow.
• Restrict network access to the MLflow API to trusted users only.

Valters IT