CVE-2025-1474

Executive Summary

CVE-2025-1474 is a medium-severity vulnerability in MLflow version 2.18 that allows an authenticated admin to create new user accounts without setting a password. This violates secure account management best practices and could lead to unauthorized access if an attacker gains the ability to create accounts or if an admin inadvertently creates an account with no password. The vulnerability is fixed in MLflow version 2.19.0.

Supply Chain & Package Security

MLflow is a Python package (PyPI: mlflow). Organizations using MLflow should verify their installed version and update to 2.19.0 or later. The vulnerability is in the user management module, which is part of the core MLflow package.

CVSS Breakdown & Threat Level

• CVSS Score: 3.8 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low. The vulnerability requires admin privileges to exploit, but it can lead to unauthorized access if an attacker compromises an admin account or if an admin creates an account without a password.

Deep Dive & Mechanics

The vulnerability exists in the user creation endpoint of MLflow's admin interface. When an admin creates a new user, the application does not enforce a password requirement. The password field can be left empty, resulting in an account with no authentication credential.

Root Cause: Lack of server-side validation for the password field during user creation. The application accepts an empty string or null value for the password.

Attack Scenario:

1. An attacker gains admin access to the MLflow instance (e.g., through credential theft or social engineering).
2. The attacker creates a new user account with no password.
3. The attacker then logs in as the new user without providing a password.
4. The attacker can then perform actions with the privileges of the new account.

Impact: Unauthorized access to MLflow resources, potential data exfiltration, or model tampering.

Vulnerable vs. Patched Code

Vulnerable Code (MLflow 2.18):

# In user management module
def create_user(username, password=None, ...):
    # No validation that password is not empty
    user = User(username=username, password=password)
    db.session.add(user)
    db.session.commit()

Patched Code (MLflow 2.19.0):

# In user management module
def create_user(username, password, ...):
    if not password or len(password.strip()) == 0:
        raise ValueError("Password cannot be empty")
    user = User(username=username, password=password)
    db.session.add(user)
    db.session.commit()

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin access to an MLflow 2.18 instance
• Network access to the MLflow API

Exploitation Steps:

1. Authenticate as an admin user.
2. Send a POST request to the user creation endpoint with an empty password:

curl -X POST https://mlflow-instance/api/2.0/mlflow/users/create \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d '{"username": "attacker_user", "password": ""}'

3. Log in as the new user without a password:

curl -X POST https://mlflow-instance/api/2.0/mlflow/users/login \
  -H "Content-Type: application/json" \
  -d '{"username": "attacker_user", "password": ""}'

Blue Team

Detection:

• Monitor for user creation events with empty or null password fields.
• Alert on accounts that log in without a password.
• Review audit logs for unusual user creation patterns.

Prevention:

• Update to MLflow 2.19.0 or later.
• Implement additional access controls on the admin interface.
• Use network segmentation to restrict access to the MLflow API.

Indicators of Compromise (IOCs)

• Log Entries: User creation events with password field empty or null.
• Network Traffic: POST requests to /api/2.0/mlflow/users/create with "password": "" in the body.
• User Accounts: Accounts with no password set (check user database for empty password hashes).

Detection Engineering

YARA Rule

rule CVE_2025_1474_MLflow_Empty_Password {
    meta:
        description = "Detects MLflow user creation with empty password"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1474"
    strings:
        $s1 = "create_user" ascii nocase
        $s2 = "password" ascii nocase
        $s3 = "username" ascii nocase
    condition:
        all of ($s*) and #s1 > 0
}

Sigma Rule

title: MLflow User Creation with Empty Password
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to create a user account with an empty password in MLflow
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: mlflow
detection:
    selection:
        event: user_created
        password: ""
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-1474 MLflow User Creation with Empty Password";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/2.0/mlflow/users/create"; http_uri;
    content:"\"password\":\"\""; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Update MLflow to version 2.19.0 or later.
2. Review all existing user accounts and ensure none have empty passwords.
3. Reset passwords for any accounts found without passwords.

Long-term:

1. Implement additional authentication controls (e.g., MFA).
2. Regularly audit user accounts and permissions.
3. Monitor for unusual account creation activity.

Workaround:

• If immediate update is not possible, restrict access to the admin interface using network controls or a reverse proxy with authentication.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert