CVE-2024-1560
Path Traversal Vulnerability in mlflow/mlflow
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Path Traversal Vulnerability in mlflow/mlflow
| Assigner | @huntr_ai |
| Reserved | 2024-02-15 |
| Published | 2024-04-16 |
| Updated | 2024-08-09 |
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the `_delete_artifact_mlflow_artifacts` handler and `local_file_uri_to_path` function, allowing for the deletion of arbitrary directories on the server's filesystem. This vulnerability is due to an extra unquote operation in the `delete_artifacts` function of `local_artifact_repo.py`, which fails to properly sanitize user-supplied paths. The issue is present up to version 2.9.2, despite attempts to fix a similar issue in CVE-2023-6831.
| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
https://huntr.com/bounties/4a34259c-3c8f-4872-b178-f27fbc876b98
