mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.
The vulnerability lies in the 'is_local_uri' function, which improperly handles URIs with empty schema or 'file' schema, incorrectly classifying them as non-local addresses. An attacker can craft a malicious model version with a specially constructed 'source' parameter containing appropriately crafted URIs. This allows the verification mechanism to be bypassed (path traversal), and the server reads and returns files outside the allowed directory — at least two directory levels from the server's root directory.
An unauthenticated attacker can read arbitrary sensitive files on the server, such as configurations, API keys, credentials, or other confidential system information. The attack can lead to serious data confidentiality breach with limited impact on system integrity.
The patch available in the MLflow repository should be applied — commit 438a450714a3ca06285eeea34bdc6cf79d7f6cbc. It is recommended to update to a version containing the above fix according to vendor references and restrict network access to MLflow instances only to trusted users.
MLflow (lfprojects/mlflow) — versions indicated in vendor references
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NLfprojects Mlflow
APPLfprojects< 2.10.0
Related vulnerabilities
MLflow is an open source AI engineering platform for agents, large language models, and machine learning model...
MLflow: nieautoryzowany dostęp do endpointów multipart upload (RCE)
MLflow: nieprawidłowa walidacja origin umożliwia RCE przez cross-origin request
Brak uwierzytelnienia w endpointach FastAPI jobs w MLflow (Auth Bypass / RCE)
Command injection w MLflow podczas inicjalizacji kontenera modelu