Path Traversal Vulnerability in mlflow/mlflow version 2.9.2

CVE-2024-1483

Summary

A path traversal vulnerability has been identified in mlflow version 2.9.2 by Databricks, which allows attackers to potentially access sensitive files on the server. This vulnerability arises from inadequate validation of user inputs within the server's request handlers. Attackers can exploit this flaw by sending specially crafted HTTP POST requests that include manipulated 'artifact_location' and 'source' parameters, utilizing a local URI formatted with '#' rather than '?'. Consequently, this can allow unauthorized access to files buried deep within the server's directory structure, posing significant risks to data security.

References