Local File Inclusion Vulnerability in mlflow Affects Version 2.9.2

CVE-2024-2928

What is CVE-2024-2928?

A Local File Inclusion (LFI) vulnerability exists in MLflow versions prior to 2.11.3, specifically identified in version 2.9.2. This flaw is due to the application's inadequate validation of URI fragments, allowing attackers to exploit directory traversal sequences such as '../'. By manipulating the fragment part of the URI, attackers could potentially access sensitive files on the local file system, including critical files like '/etc/passwd'. This vulnerability effectively bypasses prior patches that only addressed URI query string manipulations, underscoring the necessity for thorough validation across all URI components to mitigate risks associated with LFI attacks.

References