A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.
The vulnerability results from lack of validation of tar archive member paths during extraction in the file `mlflow/pyfunc/dbconnect_artifact_cache.py`. An attacker controlling the contents of a tar.gz file can place entries with specially crafted paths (e.g., containing `../` sequences) in the archive, which after extraction will write files outside the target directory. This makes it possible to escape the sandbox directory and write to any location in the file system accessible to the MLflow process.
An attacker can overwrite arbitrary files on the server or obtain elevated privileges, which in multi-tenant environments or shared clusters can lead to complete system takeover or compromise of other tenants.
MLflow should be updated to version v3.7.0 or newer, which introduces validation of tar archive member paths. Details of the fix are available in commit 3bf6d81ac4d38654c8ff012dbd0c3e9f17e7e346 in the mlflow/mlflow GitHub repository.
MLflow (mlflow/mlflow) in versions before v3.7.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HLfprojects Mlflow
APPLfprojects< 3.9.0
Related vulnerabilities
MLflow is an open source AI engineering platform for agents, large language models, and machine learning model...
MLflow: nieautoryzowany dostęp do endpointów multipart upload (RCE)
MLflow: nieprawidłowa walidacja origin umożliwia RCE przez cross-origin request
Brak uwierzytelnienia w endpointach FastAPI jobs w MLflow (Auth Bypass / RCE)
Command injection w MLflow podczas inicjalizacji kontenera modelu