CVE-2023-1177: Mlflow Path Traversal Vulnerability

CVE-2023-1177 Overview

CVE-2023-1177 is a critical path traversal vulnerability affecting MLflow, the popular open-source platform for managing the machine learning lifecycle. The vulnerability exists in versions prior to 2.2.1 and allows attackers to traverse directory structures using specially crafted path sequences containing \..\filename patterns. This enables unauthorized access to arbitrary files on the server hosting the MLflow application, potentially exposing sensitive model data, credentials, and system files.

Critical Impact

This path traversal vulnerability allows unauthenticated remote attackers to read and potentially write arbitrary files on MLflow servers, compromising machine learning pipelines and sensitive training data.

Affected Products

• MLflow versions prior to 2.2.1
• LF Projects MLflow (all platforms)
• MLflow deployments accessible over network

Discovery Timeline

• 2023-03-24 - CVE-2023-1177 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-1177

Vulnerability Analysis

This vulnerability stems from improper input validation when processing file path parameters in MLflow's API endpoints. The application fails to adequately sanitize user-supplied input containing directory traversal sequences, specifically the Windows-style backslash variant (\..\). When an attacker supplies a malicious path containing these sequences, the application resolves the path relative to its working directory, allowing traversal outside the intended directory boundaries.

The vulnerability is classified under CWE-29 (Path Traversal: '..\filename') and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The flaw is particularly severe because MLflow servers often store sensitive machine learning artifacts, model weights, and configuration files that could be exfiltrated through this attack vector.

Root Cause

The root cause lies in insufficient path canonicalization and validation within MLflow's file handling routines. When the application receives file path parameters from API requests, it does not properly normalize paths or validate that the resolved path remains within the expected directory structure. The specific issue involves the handling of backslash directory separators combined with parent directory references (..), which bypass security checks that may only filter forward-slash variants.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker sends crafted HTTP requests to MLflow API endpoints, embedding path traversal sequences in parameters that accept file paths. The server processes these requests and returns contents of files outside the intended directories, or allows writing to unauthorized locations.

The vulnerability is exploited through network-accessible MLflow instances. Attackers craft malicious requests containing path traversal patterns like \..\..\..\etc\passwd or \..\..\..\..\windows\system32\config\sam depending on the target operating system. The server's failure to sanitize these inputs allows the attacker to escape the application's root directory and access sensitive system or application files.

For technical exploitation details, refer to the Huntr Vulnerability Bounty report.

Detection Methods for CVE-2023-1177

Indicators of Compromise

• HTTP requests to MLflow endpoints containing \..\ or encoded variants (%5C%2E%2E%5C)
• Unusual file access patterns in MLflow server logs showing paths outside expected directories
• API requests attempting to access sensitive system files such as /etc/passwd, /etc/shadow, or Windows SAM database
• Abnormal outbound data transfers from MLflow server containing sensitive file contents

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns including backslash variants
• Monitor MLflow API access logs for requests containing suspicious path sequences or encoded characters
• Deploy file integrity monitoring on MLflow artifact directories to detect unauthorized access attempts
• Use SentinelOne Singularity Platform to detect exploitation attempts through behavioral analysis of file system access patterns

Monitoring Recommendations

• Enable verbose logging on MLflow servers to capture full request parameters
• Configure alerts for any file access outside designated MLflow artifact directories
• Monitor network traffic for unusual file exfiltration patterns from MLflow servers
• Implement endpoint detection and response (EDR) solutions to identify post-exploitation activities

How to Mitigate CVE-2023-1177

Immediate Actions Required

• Upgrade MLflow to version 2.2.1 or later immediately
• Restrict network access to MLflow servers using firewall rules and network segmentation
• Implement authentication and authorization controls if not already in place
• Audit MLflow server logs for signs of prior exploitation attempts

Patch Information

The vulnerability has been addressed in MLflow version 2.2.1. The fix implements proper path validation and canonicalization to prevent directory traversal attacks. Organizations should update their MLflow installations to the patched version as soon as possible.

The patch commit is available at the GitHub Pull Request Commit. Additional details about the vulnerability and its remediation can be found in the Huntr Vulnerability Bounty report.

Workarounds

• Deploy a reverse proxy or WAF in front of MLflow to filter malicious path traversal patterns
• Restrict MLflow server network exposure to trusted networks only until patching is complete
• Run MLflow with minimal file system permissions using principle of least privilege
• Implement container isolation for MLflow deployments to limit blast radius of potential exploitation

# Configuration example - Restrict MLflow network access using firewall rules
# Allow access only from trusted networks
iptables -A INPUT -p tcp --dport 5000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP

# Run MLflow with restricted user permissions
useradd -r -s /bin/false mlflow-service
chown -R mlflow-service:mlflow-service /opt/mlflow
sudo -u mlflow-service mlflow server --host 127.0.0.1 --port 5000