Arbitrary Code Execution Vulnerability in MLflow Platform

CVE-2024-37056

Summary

The MLflow platform developed by Databricks, specifically from version 1.23.0 onwards, exhibits a vulnerability that allows for the deserialization of untrusted data. This can lead to severe security implications, where a malicious user can upload a LightGBM model created using scikit-learn. Once interacted with by an end user, the model can execute arbitrary code on their system, posing a significant risk to the integrity and confidentiality of the affected environment. It is crucial for users of the platform to review their implementations and ensure they apply necessary security measures.

References