MLflow Weak Password Requirements Authentication Bypass Vulnerability

@@ -2,5 +2,5 @@
 default_permission = READ
 database_uri = sqlite:///basic_auth.db
 admin_username = admin
-admin_password = password
+admin_password = password1234
 authorization_function = mlflow.server.auth:authenticate_request_basic_auth

@@ -782,7 +782,7 @@ def signup():
   <br>
   <label for="password">Password:</label>
   <br>
-  <input type="password" id="password" name="password" minlength="4">
+  <input type="password" id="password" name="password" minlength="12">
   <br>
   <br>
   <input type="submit" value="Sign up">

@@ -20,7 +20,7 @@
 from mlflow.server.auth.permissions import _validate_permission
 from mlflow.store.db.utils import _get_managed_session_maker, create_sqlalchemy_engine_with_retry
 from mlflow.utils.uri import extract_db_type_from_uri
-from mlflow.utils.validation import _validate_username
+from mlflow.utils.validation import _validate_password, _validate_username
 
 
 class SqlAlchemyStore:
@@ -42,6 +42,7 @@ def authenticate_user(self, username: str, password: str) -> bool:
 
     def create_user(self, username: str, password: str, is_admin: bool = False) -> User:
         _validate_username(username)
+        _validate_password(password)
         pwhash = generate_password_hash(password)
         with self.ManagedSessionMaker() as session:
             try:

@@ -623,6 +623,13 @@ def _validate_username(username):
         raise MlflowException("Username cannot be empty.", INVALID_PARAMETER_VALUE)
 
 
+def _validate_password(password) -> None:
+    if password is None or len(password) < 12:
+        raise MlflowException.invalid_parameter_value(
+            "Password must be a string longer than 12 characters."
+        )
+
+
 def _validate_trace_tag(key, value):
     _validate_tag_name(key)
     key = _validate_length_limit("key", MAX_TRACE_TAG_KEY_LENGTH, key)

@@ -52,7 +52,7 @@ def random_int(lo=1, hi=1e10):
     return random.randint(lo, hi)
 
 
-def random_str(size=10):
+def random_str(size=12):
     msg = (
         "UUID4 generated strings have a high potential for collision at small sizes. "
         "10 is set as the lower bounds for random string generation to prevent non-deterministic "

@@ -345,7 +345,8 @@ def test_create_and_delete_registered_model(client, monkeypatch):
         response = requests.get(
             url=client.tracking_uri + GET_REGISTERED_MODEL_PERMISSION,
             params={"name": rm.name, "username": username1},
-            auth=("admin", "password"),  # Check with admin because the user permission is deleted
+            # Check with admin because the user permission is deleted
+            auth=("admin", "password1234"),
         )
 
     assert response.status_code == 404