Remote Code Execution Vulnerability in mlflow/mlflow version 8.2.1

CVE-2024-0520

Summary

A vulnerability identified in MLflow version 8.2.1 exposes the application to potential remote code execution due to inadequate sanitization of file paths derived from HTTP headers. The flaw resides within the mlflow.data.http_dataset_source.py module, where user-controlled input from the Content-Disposition header or URL path may be mishandled. Through path traversal techniques, an attacker can manipulate the file path to perform arbitrary file write operations. This could result in command execution on the server, leading to unauthorized access to sensitive data and machine learning models. Users are strongly advised to upgrade to version 2.9.0 or later to mitigate this vulnerability.

References