Path Traversal Vulnerability in MLflow Product by Databricks

CVE-2024-8859

Summary

A path traversal vulnerability has been identified in MLflow version 2.15.1 developed by Databricks. This vulnerability occurs when users configure and utilize the DBFS service, allowing an attacker to read arbitrary files. The issue arises due to inadequate validation of the URL; only the path portion is checked, leaving other components, such as query strings and parameters, unverified. The vulnerability is provoked if the DBFS service is mounted to a local directory during its use.

References