mlflow Vulnerable to Local File Inclusion (LFI) Attacks

CVE-2024-3573

What is CVE-2024-3573?

The vulnerability in mlflow pertains to Local File Inclusion (LFI) that arises from inadequate handling of URI parsing. Specifically, the 'is_local_uri' function fails to accurately assess URIs with empty or 'file' schemes. This oversight allows attackers to exploit the system by crafting malicious model versions that contain specially manipulated 'source' parameters. By doing so, they can bypass local checks and gain unauthorized access to sensitive files located within a two-directory scope from the server's root. Such misclassification of URIs creates significant risks, enabling malicious actors to potentially exfiltrate confidential data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References