Vulnerability · Published Jun 6, 2024 · Assigned by @huntr_ai
CVE-2024-2928Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
High 7.5
In plain English
A high-severity security flaw in mlflow/mlflow from mlflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 21.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mlflow | 2.11.3 | GHSA-j46q-5pxx-8vmw |
| PyPI | mlflow | 2.11.3 | PYSEC-2024-242 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mlflow | mlflow/mlflow | unspecified – before 2.11.3 |
Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N