CVE-2025-15036

Executive Summary

CVE-2025-15036 is a critical path traversal vulnerability in MLflow, a popular open-source platform for the machine learning lifecycle. The flaw resides in the extract_archive_to_dir function within mlflow/pyfunc/dbconnect_artifact_cache.py. An attacker with control over a tar.gz file can exploit this to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments. The vulnerability has a CVSS score of 10.0, indicating maximum severity, and affects all versions before 3.7.0. A patch is available in version 3.7.0.

Supply Chain & Package Security

MLflow is distributed as a Python package via PyPI. Organizations using MLflow in their ML pipelines should immediately update to version 3.7.0 or later. The vulnerability can be exploited by an attacker who can supply a malicious tar.gz artifact to an MLflow server, making it a supply chain risk if untrusted artifacts are processed.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability allows an unauthenticated attacker to overwrite arbitrary files on the server, potentially leading to remote code execution or complete compromise of the MLflow instance.

Deep Dive & Mechanics

The vulnerability is in the extract_archive_to_dir function, which extracts tar.gz files without validating the paths of the contained files. A malicious tar.gz can contain files with path traversal sequences (e.g., ../../etc/passwd) that, when extracted, write to locations outside the intended extraction directory.

In multi-tenant or shared cluster environments, an attacker could:

1. Upload a crafted tar.gz artifact to an MLflow server.
2. The server extracts the archive to a sandbox directory.
3. Due to lack of path validation, files are written to arbitrary locations (e.g., overwriting configuration files, SSH keys, or scripts).
4. This can lead to privilege escalation or remote code execution.

The fix in version 3.7.0 adds validation to ensure all extracted paths are within the target directory.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.7.0):

def extract_archive_to_dir(archive_path, dest_dir):
    with tarfile.open(archive_path, 'r:gz') as tar:
        tar.extractall(path=dest_dir)

Patched Code (3.7.0+):

import os

def extract_archive_to_dir(archive_path, dest_dir):
    with tarfile.open(archive_path, 'r:gz') as tar:
        for member in tar.getmembers():
            # Validate the member path to prevent path traversal
            member_path = os.path.normpath(os.path.join(dest_dir, member.name))
            if not member_path.startswith(os.path.normpath(dest_dir)):
                raise ValueError(f"Invalid path in archive: {member.name}")
            tar.extract(member, path=dest_dir)

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would craft a malicious tar.gz file containing files with path traversal sequences. For example:

# Create a malicious tar.gz that overwrites /etc/passwd
mkdir exploit
cd exploit
ln -s /etc/passwd ../../etc/passwd
tar -czf malicious.tar.gz ../../etc/passwd

Then upload this file to an MLflow server that processes tar.gz artifacts. The server will extract the archive, and the symlink will overwrite the target file.

Blue Team

To detect exploitation attempts:

1. Monitor for unusual file writes outside the expected extraction directory.
2. Implement file integrity monitoring on critical system files.
3. Use the detection rules provided below.

Indicators of Compromise (IOCs)

• File Hashes: (None publicly available)
• Network Indicators: Unusual tar.gz uploads to MLflow endpoints (e.g., /api/2.0/mlflow-artifacts/artifacts/upload)
• File System Indicators: Unexpected files in /tmp/ or other extraction directories with path traversal patterns
• Log Indicators: MLflow logs showing extraction of archives with suspicious member names containing ../

Detection Engineering

YARA Rule

rule CVE_2025_15036_MLflow_Path_Traversal {
    meta:
        description = "Detects malicious tar.gz files attempting path traversal in MLflow"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15036"
    strings:
        $path_traversal = /\.\.\/[^\/]+/
    condition:
        $path_traversal
}

Sigma Rule

title: MLflow Path Traversal via Tar Extraction
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects extraction of tar.gz files with path traversal patterns in MLflow
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'tarfile.extractall'
    condition: selection
falsepositives:
    - Legitimate use of tar extraction with controlled paths
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15036 MLflow Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/2.0/mlflow-artifacts/artifacts/upload"; http_uri; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade MLflow to version 3.7.0 or later.
2. Workaround: If upgrade is not possible, implement input validation on all uploaded tar.gz files to reject those containing path traversal sequences.
3. Network: Restrict access to MLflow endpoints to trusted IPs only.
4. Monitoring: Enable detailed logging of artifact uploads and extraction operations.
5. Sandboxing: Run MLflow in a containerized environment with restricted file system permissions.

Report generated by Valters IT DevSecOps & CTI Expert System
Signature: Valters IT

{/* [Security Hash: 1441BAFEC1146579EE8251C8] */}