Path traversal vulnerability in mlflow repository

CVE-2024-1594

Summary

A path traversal vulnerability has been identified in the mlflow platform, specifically affecting the handling of the artifact_location parameter during the creation of experiments. This weakness allows attackers to craft a malicious URI that includes a fragment component, enabling them to access arbitrary files on the server running the affected version of mlflow. By exploiting this flaw, an attacker can read sensitive information, putting server integrity and data confidentiality at significant risk. This vulnerability exhibits similar characteristics to other previously identified issues but utilizes a different approach in URI manipulation. Ensuring robust input validation and sanitization mechanisms is essential to mitigate the potential exploitation of this type of vulnerability.

References