Local File Read via Path Traversal in mlflow/mlflow

Vulnerability

Overview A path traversal vulnerability exists in the mlflow/mlflow repository, specifically in the handling of the artifact_location parameter when creating an experiment. By including a fragment component # in the artifact location URI, an attacker can read arbitrary files on the server within the context of the server's process. This issue is similar to CVE-2023-6909 but uses a different URI component to achieve the same effect [1].

Exploitation

To exploit this vulnerability, an attacker must have the ability to create or modify experiments in an MLflow instance. By crafting a malicious artifact_location URI containing a # fragment, the attacker can bypass path validation and read files outside the intended artifact directory. No authentication is strictly required if the MLflow tracking server is exposed without access controls. The attack can be performed via the MLflow API or UI when creating an experiment [4].

Impact

Successful exploitation allows an attacker to read arbitrary files on the server, potentially exposing sensitive information such as configuration files, credentials, or machine learning models. This could lead to further compromise of the MLflow instance and associated infrastructure.

Mitigation

The vulnerability has been addressed in recent versions of MLflow. Users are strongly advised to upgrade to the latest patched version and restrict access to the MLflow tracking server. Additionally, input validation on the artifact_location parameter should be enforced to prevent traversal attacks [3][4].