CVE-2024-3848: Path Traversal Bypass in mlflow/mlflow
First published: Thu May 16 2024(Updated: )
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/mlflow | >=2.9.2<2.12.1 | 2.12.1 |
| MLflow | <2.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3848?
CVE-2024-3848 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2024-3848?
To fix CVE-2024-3848, upgrade to mlflow version 2.12.1 or higher immediately.
What causes CVE-2024-3848?
CVE-2024-3848 is caused by improper handling of artifact URLs that allows for path traversal via the '#' character in URL fragments.
Which versions of mlflow are affected by CVE-2024-3848?
CVE-2024-3848 affects mlflow versions prior to 2.12.1.
Was CVE-2024-3848 related to any previous vulnerabilities?
Yes, CVE-2024-3848 is a bypass for the previously addressed CVE-2023-6909.
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/references
- agent/author
- collector/github-advisory
- source/GitHub
- alias/GHSA-rfqq-wq6w-72jm
- alias/CVE-2024-3848
- agent/software-canonical-lookup
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- collector/github-advisory-latest
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/pip
- vendor/lfprojects
- canonical/mlflow