CVE-2024-3573

Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

En bref

Sévérité: CRITICAL 9.3
EPSS: EPSS 0.73 % · centile 54 (2026-10-27)
État: PUBLISHED
Publiée: 2024-04-16
Mise à jour: 2024-08-01
Attribuée par: @huntr_ai
Statut NVD: Analyzed

Description

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	CRITICAL 9.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	@huntr_ai
CVSS 3.1	CRITICAL 9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.0	CRITICAL 9.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	NVD · security@huntr.dev (Secondary)

Faiblesses (CWE)

Avis

GHSA-hq88-wg7q-gp4g — mlflow vulnerable to Path Traversal
PYSEC-2024-243 — mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the s

Références européennes

ENISA EUVD · EUVD-2024-1218
GCVE · GCVE-0-2024-3573

Configurations affectées (CPE NVD)

cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* < 2.10.0

Produits affectés

Produit	Versions
mlflow · mlflow/mlflow	affected unspecified < 2.10.0

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD