CVE-2025-52967

Executive Summary

CVE-2025-52967 is a medium-severity vulnerability in MLflow, an open-source platform for the machine learning lifecycle. The flaw resides in the gateway_proxy_handler component, which lacks proper validation of the gateway_path parameter. This oversight allows an unauthenticated attacker to craft requests that bypass intended access controls, potentially leading to unauthorized access to internal resources or services behind the MLflow Gateway. The vulnerability affects MLflow versions prior to 3.1.0. While no public proof-of-concept (PoC) or exploit code is currently available, the risk is elevated due to the unpatched status and the potential for server-side request forgery (SSRF) or path traversal attacks.

Supply Chain & Package Security

MLflow is distributed as a Python package via PyPI. Organizations using MLflow should verify their installed version and update to 3.1.0 or later. The vulnerability does not directly affect the supply chain of the package itself, but the lack of input validation in a core component could be exploited to compromise downstream systems.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The lack of a public exploit and low EPSS score (0.0%) reduce immediate risk, but the unpatched status and potential for SSRF or path traversal make it a concern for exposed MLflow instances.

Deep Dive & Mechanics

The gateway_proxy_handler in MLflow is responsible for proxying requests to backend services configured in the MLflow Gateway. The vulnerability arises because the handler does not validate the gateway_path parameter before using it to construct the target URL. An attacker can supply a malicious gateway_path value, such as ../../etc/passwd or http://internal-service:8080, to perform path traversal or server-side request forgery (SSRF).

Root Cause: Missing input validation on the gateway_path parameter in the gateway_proxy_handler function.

Attack Scenario:

1. An attacker sends a crafted HTTP request to the MLflow Gateway endpoint, e.g., POST /gateway/proxy?gateway_path=../../etc/passwd.
2. The handler uses the unsanitized gateway_path to construct a request to an internal resource.
3. The attacker can read sensitive files or interact with internal services.

Impact:

• Unauthorized access to internal files (path traversal).
• SSRF attacks against internal services (e.g., cloud metadata endpoints, databases).
• Potential for further lateral movement within the network.

Vulnerable vs. Patched Code

Vulnerable Code (MLflow < 3.1.0):

# gateway_proxy_handler.py (simplified)
def gateway_proxy_handler(request):
    gateway_path = request.args.get('gateway_path')
    # No validation of gateway_path
    target_url = f"http://backend-service/{gateway_path}"
    response = requests.get(target_url)
    return response.content

Patched Code (MLflow >= 3.1.0):

# gateway_proxy_handler.py (simplified)
import re

def gateway_proxy_handler(request):
    gateway_path = request.args.get('gateway_path')
    # Validate gateway_path against allowed patterns
    if not re.match(r'^[a-zA-Z0-9_/-]+$', gateway_path):
        return "Invalid gateway_path", 400
    target_url = f"http://backend-service/{gateway_path}"
    response = requests.get(target_url)
    return response.content

The patch introduces a whitelist-based validation using a regular expression that only allows alphanumeric characters, underscores, slashes, and hyphens. This prevents path traversal and SSRF attacks.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable MLflow instance (version < 3.1.0) using Docker:

   docker run -d -p 5000:5000 --name mlflow-vuln mlflow/mlflow:2.0.0
   

2. Ensure the MLflow Gateway is enabled and configured with a backend service.

Exploitation Steps:

1. Path Traversal:

   curl "http://target:5000/gateway/proxy?gateway_path=../../etc/passwd"
   

2. SSRF to Internal Service:

   curl "http://target:5000/gateway/proxy?gateway_path=http://169.254.169.254/latest/meta-data/"
   

3. SSRF to Internal Database:

   curl "http://target:5000/gateway/proxy?gateway_path=http://internal-db:5432/"
   

Blue Team (Defensive)

Detection:

• Monitor for requests to /gateway/proxy with suspicious gateway_path parameters (e.g., containing ../, http://, file://).
• Alert on unusual outbound connections from the MLflow server to internal IPs or unexpected ports.

Mitigation:

• Immediately upgrade to MLflow 3.1.0 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block malicious gateway_path values.
• Restrict outbound network access from the MLflow server to only necessary services.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /gateway/proxy with gateway_path containing ../, http://, file://, or IP addresses.
  • Outbound connections from the MLflow server to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) on non-standard ports.
• File IOCs:
  • Unauthorized access to /etc/passwd, /etc/shadow, or other sensitive files.
• Log IOCs:
  • MLflow access logs showing requests with unusual gateway_path values.

Detection Engineering

YARA Rule

rule CVE_2025_52967_MLflow_Gateway_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in MLflow gateway_proxy_handler"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-52967"
    strings:
        $path_traversal = "../"
        $ssrf_http = "http://"
        $ssrf_file = "file://"
    condition:
        any of them
}

Sigma Rule

title: MLflow Gateway Path Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2025-52967 via path traversal or SSRF in MLflow gateway_proxy_handler
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: mlflow
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - 'http://'
            - 'file://'
    condition: selection
falsepositives:
    - Legitimate use of proxy to external resources (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52967 MLflow Gateway Path Traversal Attempt"; flow:to_server; content:"/gateway/proxy"; http_uri; content:"gateway_path"; http_uri; pcre:"/(\.\.\/|http:\/\/|file:\/\/)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MLflow to version 3.1.0 or later.
2. Apply WAF rules to block requests with suspicious gateway_path values.
3. Restrict network access from the MLflow server to only trusted internal services.

Long-Term Measures:

• Implement input validation for all user-supplied parameters.
• Conduct regular security audits of MLflow deployments.
• Monitor for new CVEs and apply patches promptly.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.